chore(workspace): add hardened startup/security workflows and skill suite

skills/git-workspace-hygiene/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: git-workspace-hygiene
+description: Maintain safe, low-noise Git workflows for OpenClaw workspaces. Use when initializing repository tracking, creating secure .gitignore rules, making clean checkpoint commits, reviewing diffs, preventing secret leaks, and preparing rollback-friendly history.
+---
+
+# Git Workspace Hygiene
+
+## Goals
+
+- Keep change history clear and reversible.
+- Prevent accidental commits of secrets and noisy runtime files.
+- Encourage small, meaningful checkpoints.
+
+## Setup workflow
+
+1. Ensure repository exists (`git init` if missing).
+2. Create/update `.gitignore` with workspace-safe defaults.
+3. Verify ignored files include credentials, env files, logs, and transient runtime state.
+4. Stage intended files only.
+5. Create baseline commit.
+
+## Commit hygiene rules
+
+- Prefer small scoped commits (one concern per commit).
+- Use Conventional Commits format: `<type>(<scope>): <summary>`.
+  - Types: `feat`, `fix`, `docs`, `chore`, `refactor`, `test`, `build`, `ci`.
+  - Examples: `chore(boot): harden startup checks`, `feat(skills): add inbox-triage`.
+- Review `git diff --staged` before committing.
+- Never commit tokens/secrets.
+
+## Quick review routine
+
+1. `git status --short`
+2. `git diff --stat`
+3. `git diff --staged`
+4. Run secret/noise scan script: `skills/git-workspace-hygiene/scripts/precommit-scan.sh`
+5. Commit only after clean scan
+
+## Rollback playbook
+
+- Inspect history: `git log --oneline --decorate -n 20`
+- Undo last commit (keep changes): `git reset --soft HEAD~1`
+- Restore a file from HEAD: `git restore <path>`
+- Revert committed change safely: `git revert <commit>`
+
+## Optional cadence
+
+- Create end-of-day checkpoint commit if meaningful changes accumulated.
+- Tag stable milestones (`git tag <name>`) when workflow is known-good.