feat: enforce lint checks as gate for commits and CI (#54)

- Add PHP syntax check to lint-staged via scripts/lint-php.sh
- Add lint:php script to package.json
- Update lint script to include PHP checks
- Create scripts/safe-commit.sh for AI agent use
- Update deploy-test.yml: lint jobs as gate before deploy
- Add branch protection for main requiring status checks
- Update AGENTS.md with pre-commit hook rules for agents

Also addresses #53: CI requires lint checks before merge

Co-authored-by: Claw <claw@openclaw.local>

scripts/safe-commit.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# safe-commit.sh – Commit with pre-commit hooks guaranteed to run
+# Usage: ./scripts/safe-commit.sh "commit message"
+#
+# This script ensures lint checks always execute, even when committing
+# from non-interactive contexts (CI, AI agents, etc.).
+
+set -euo pipefail
+
+if [ -z "${1:-}" ]; then
+  echo "❌ Usage: ./scripts/safe-commit.sh \"commit message\""
+  exit 1
+fi
+
+MSG="$1"
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+# Ensure hooks directory exists and is configured
+if [ -d ".husky" ]; then
+  git config core.hooksPath .husky
+fi
+
+# Run lint-staged manually as a safety net (in case hook is skipped)
+if command -v npx &>/dev/null && [ -f "node_modules/.bin/lint-staged" ]; then
+  echo "🔍 Running pre-commit lint checks..."
+  npx lint-staged || {
+    echo ""
+    echo "❌ Lint checks failed. Commit aborted."
+    echo "   Fix the errors above and try again."
+    exit 1
+  }
+  echo "✅ All lint checks passed."
+fi
+
+# Commit with hooks enabled (no --no-verify)
+git commit -m "$MSG"