feat(gitflow): universal gitflow model — lib + skill + orchestrator wiring

lib core (start/finish/init, transactional bootstrap) + migrate + 57-test suite + aiguillage; skills/gitflow + gitignore template; CLAUDE.md gitflow rule; wiring init-project (5f/8/11), onboard (2.6), ship-feature (0/4/9), feat/bugfix/hotfix aiguillage.

CLAUDE.md

@@ -162,6 +162,39 @@ All web API endpoints must be versioned from day one: `/api/v1/...`.
   behavior to match newer one.
 - Router structure reflects versioning explicitly (e.g. `api/v1/routes/`).
 
+## Version control — gitflow (universal)
+
+Every git action follows gitflow — inside a skill AND for ad-hoc commits made
+outside one on direct request. The model is universal across all projects.
+
+### Branch model
+`main` (prod) · `develop` (integration, off main) · `feature/*` + `bugfix/*`
+(off develop → develop) · `release/*` (off develop → main + back-merge develop)
+· `hotfix/*` (off main → main + develop [+ any open release/*]). `master`→`main`
+everywhere.
+
+### Rules for every git action
+- **Never commit code directly on `main` or `develop`.** Branch first from the
+  correct base, named `<type>/<name>`. (`.claude/**` memory/config commits are
+  exempt — they follow the work, not the code's gitflow.)
+- **Branch + merge via the lib, never by hand** — the directed-merge + hotfix
+  fan-out logic lives there once:
+  `bash ~/.claude/lib/gitflow.sh start <type> <name>` · `… finish`.
+- **`gitflow finish` (merge) only on an explicit human signal** ("merge it",
+  "feature OK") — never because tests pass, a plan step says "merge", or a verb
+  ("ship") implied it.
+- **Assistance flows** (`/feat` `/bugfix` `/hotfix`) auto-branch on a protected
+  base (the aiguillage); on a working branch they commit in place, never finish.
+- **New/onboarded projects** get the model + the versioned pre-commit hook via
+  `gitflow init` (init-project STEP 5f, onboard STEP 2.6).
+
+### Enforcement layers
+Advisory — it can be forgotten on a long conversation (no reliable oracle). The
+deterministic backstops are the per-repo **pre-commit hook** (`gitflow init`
+installs it: blocks code commits on main/develop, exempts `.claude/**` + merges +
+the root commit) and **Gitea branch protection** on `main`/`develop` (set up by
+the migration). Don't lean on `--no-verify` to bypass them.
+
 ## Security — non-negotiable defaults
 
 Apply at every dev step: design, scaffolding, implementation, review.