add coding-ethos submodule and minor fixes

[paudley]

This pull request introduces two new ETHOS-grounded skills for code remediation and adds a security scanning configuration, further enforcing code quality and security standards across the codebase. Additionally, it updates the tool configuration hash registry to reflect the new security config. The main themes are the codification of remediation practices and the integration of security tooling.

ETHOS Skills Documentation:

• Added .agents/skills/lint-remediation/SKILL.md, providing detailed, principle-driven guidance on how to address lint and static analysis findings structurally, rather than via suppressions or config weakening. This document outlines workflows, anti-patterns, and output discipline for handling findings from tools like Ruff, mypy, Bandit, and more.
• Added .agents/skills/conditional-imports/SKILL.md, which describes ETHOS policies and workflows for remediating conditional imports, local imports, and cyclic dependencies in Python. It emphasizes protocol-first design, SOLID principles, and strict handling of dependencies.

Security Tooling Integration:

• Introduced .bandit.yml, a configuration file for the Bandit Python security scanner, explicitly grounded in the "static-analysis-is-the-first-line-of-defense" principle. The config excludes test, build, and dependency directories from scans.

Tooling Registry Update:

• Updated .code-ethos/tool-config-hashes.json to include the new .bandit.yml file and its hash, ensuring the tool registry remains consistent and up-to-date with the enforced config files.

[gemini-code-assist]

Code Review

This pull request introduces the "coding-ethos" framework, incorporating agent skill documentation, standardized linter configurations, and automated git hooks. It also updates PostgreSQL Docker settings and adds a network guard script. Feedback identifies critical portability issues caused by hardcoded absolute paths in configuration files and a violation of the "Fail Fast" principle in the network guard script, which hangs in an infinite loop when dependencies are missing. Additionally, the duplication of documentation files across directories was flagged as a maintenance risk.

[gemini-code-assist]

The configuration file contains multiple hardcoded absolute paths to a specific user's home directory (/home/paudley/...). This makes the setup non-portable and will cause all hooks and MCP servers to fail on any other machine. Please use relative paths (e.g., ./coding-ethos/bin/...) or environment variables to resolve the coding-ethos-run binary.

[gemini-code-assist]

Hardcoded absolute path detected. This configuration is not portable. Use a relative path to the submodule binary instead.

Suggested change

	"command": "/home/paudley/Active.running/core_data/coding-ethos/bin/coding-ethos-run",
	"command": "./coding-ethos/bin/coding-ethos-run",

[gemini-code-assist]

Hanging the script in an infinite loop when a dependency is missing violates the 'Fail Fast' principle. If the network guard is not required, the script should log the warning and exit 0. If it is required, it should exit 1. Hanging makes the service appear 'running' while it is actually failing to provide any protection, which is a form of silent degradation.

Suggested change

	while true; do
	sleep "${CHECK_INTERVAL}"
	done
	exit 0

References

1. Crash early on ambiguous startup and configuration states instead of degrading silently.

[gemini-code-assist]

Similar to the previous check, avoid hanging the script. Exit gracefully if the capability is optional, or fail hard if it is required.

Suggested change

	while true; do
	sleep "${CHECK_INTERVAL}"
	done
	exit 0

References

1. Crash early on ambiguous startup and configuration states instead of degrading silently.

[gemini-code-assist]

This directory (.codex/skills/) contains an exact duplicate of the skills documentation found in .agents/skills/. Duplicating documentation increases maintenance overhead and the risk of information divergence. Consider using a single location for these files.