chore(repo): wire dira cloud capture into this repo

[azlekov]

Summary

We shipped dira cloud init in v0.6.0 but never ran it against our own repository, so cloud agent sessions on dirahq-cli were not instrumented at all. This PR fixes that — dogfooding the teleport feature on the repo that produces it.

Running dira cloud init --harness claude adds:

• .dira/hook.sh — the portable forwarder that resolves dira at run time (PATH → ~/.local/bin → /usr/local/bin) and carries the always-exit-0 hook contract.
• .dira/bootstrap.sh — the SessionStart teleport: installs the pinned release in a cloud VM, starts the daemon, claims a runner-token device, then forwards the event. On an ordinary machine it skips provisioning and forwards straight through.
• .dira/.gitattributes — LF normalization so a Windows checkout can't turn #!/bin/sh into a CRLF file.
• .claude/settings.json — the project hook entries invoking those wrappers (8/8 Claude Code events).

The blocking change: un-ignoring .claude/settings.json

.gitignore ignored .claude/settings.json with the note "Machine-specific Claude Code settings (generated per-machine by dira init)". That is correct for dira init, whose output embeds one machine's absolute dira path — but it also silently swallowed the dira cloud init output, which is deliberately portable and only works if committed, since the repository is the sole delivery channel into an ephemeral cloud VM. Without this change the .dira/ scripts would commit but nothing would ever invoke them.

.claude/settings.local.json stays ignored, matching Claude Code's shared-vs-personal settings split.

Known follow-up, not addressed here: a contributor who runs plain dira init locally will now dirty a tracked file with machine-specific absolute paths. Worth either teaching dira init to prefer settings.local.json for the project scope, or documenting it in CONTRIBUTING.md.

Note on the pin

The committed bootstrap.sh pins v0.6.0 but carries no embedded digests. The generating dira was a debug build in a sandbox whose proxy rejected the digest fetch (invalid peer certificate: UnknownIssuer), so generation fell back to the documented unpinned form: the tarball is verified against the release's own .sha256 asset at install time. The download is still cryptographically verified — just one fetch later. Re-running dira cloud init from an installed dira with unproxied GitHub access will embed the digests; I deliberately did not hand-edit the generated file to add them.

Test plan

Verified live in a Claude Code on the web container (CLAUDE_CODE_REMOTE set), which is the runtime this wiring targets:

• sh .dira/bootstrap.sh --provision-only installed the v0.6.0 x86_64-unknown-linux-musl release, checksum-verified, and started dirad.
• dira doctor → 18 ok, 1 warning, 0 failures. Relevant checks: hooks.config 8/8 events wired · cloud.runtime detected claude-web · cloud.reachability app.dirahq.sh answered · device.link linked · sync.health healthy · cloud.bootstrap teleport artifacts present. The lone warning is daemon.supervision (pidfile, no restart-after-reboot), which is expected and irrelevant in an ephemeral container.
• dira status showed the live session being captured, and the sync cursor advanced with the pending queue draining — events reached the cloud.
• sh -n clean on both generated scripts.

Checks run locally before pushing (just is not installed in that container, so the recipes were run directly):

• cargo fmt --all -- --check — clean
• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo test --workspace — 33 suites, 1207 passed, 0 failed (cargo exit 0)
• just contract equivalent (emit-schema + sign_vector) — zero drift
• Not applicable: no /contract source change, no change to the signed byte stream, no install.sh / install.ps1 change.

GitHub CI on 38554f7 is green across the board: Commit Lint, Rust (capture layer), Rust (windows), Shell Lint, PowerShell Lint, Dependency licenses, and zavet / check all succeeded.

Checklist

• Commit is signed off (git commit -s) per the DCO — note: signed off as the container's configured git identity (Claude <noreply@anthropic.com>); re-sign under your own identity if the DCO check requires a human signer.
• Conventional Commits with mandatory scope — chore(repo). chore has no releaseRules entry in .releaserc.js, so this cuts no release despite repo being a release-triggering scope.
• Targets develop, not main.
• Capture stays metadata-only — this PR adds no capture code, only the generated wiring.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SJkrxbWMxfDXnWEcuZbAfx

[github-actions]

Knowledge layer

Check	Result
Decision checks	passed
Guard trailers	passed

Spec currency is reported in the job summary and never fails a build, the same severity the local pre-commit hook uses.