M7: polish + E2E + docs (layout pass, theming, states, e2e driver, schema, setup.md, security)

.pre-commit-config.yaml

@@ -0,0 +1,15 @@
+# Committed pre-commit config so a fresh clone gets the hermes-agent/ guard
+# without manual hook installation (scripts/guard_hermes_agent.sh --staged
+# fails the commit if any hermes-agent/ path is staged — that directory is a
+# read-only research reference, see .gitignore and docs/00-overview.md).
+#
+# Install: pre-commit install
+repos:
+  - repo: local
+    hooks:
+      - id: guard-hermes-agent
+        name: guard hermes-agent/ (read-only research reference)
+        entry: scripts/guard_hermes_agent.sh --staged
+        language: system
+        pass_filenames: false
+        always_run: true