feat(hh): graceful shutdown, crypt default theme, neutralize branding, share-prep

- Graceful shutdown: Ctrl+C quits in chat (interrupts PTY while driving),
  RAII TermGuard + panic hook + SIGTERM/SIGHUP always restore the terminal
- Default theme is now "crypt" (neutral monochrome); theme sigil mirrored in
  chat/roster/help so the pentagram only renders under the "church" theme
- Neutralize inverted-pentagram branding across CLI, scripts, docs, and Cargo
  metadata (kept only in themes/church.toml + the render-time placeholder)
- Rewrite root README around hack-house; add bootstrap.sh, SECURITY.md,
  CODE_OF_CONDUCT.md, CHANGELOG.md, and issue/PR templates
- .gitignore cleanup; stop tracking .venv

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hh/direnv-autostart/.envrc

@@ -1,4 +1,4 @@
-# .envrc — cd into this directory to summon your hack-house ⛧
+# .envrc — cd into this directory to summon your hack-house
 #
 # Powered by direnv (https://direnv.net). Run ./setup.sh once to install direnv,
 # hook your shell, and `direnv allow` this file.
@@ -27,9 +27,9 @@ gen_pw() {
 # $HH_USER, then (inside tmux) switches your client into it. Guard against
 # stacking: if the session is already live, just point at it.
 if ! command -v tmux >/dev/null 2>&1; then
-    echo "⛧ install tmux to autostart your hack-house"
+    echo "install tmux to autostart your hack-house"
 elif tmux has-session -t "$SESSION" 2>/dev/null; then
-    echo "⛧ '$SESSION' already live — tmux attach -t $SESSION   (reveal its password in-app with /pw)"
+    echo "'$SESSION' already live — tmux attach -t $SESSION   (reveal its password in-app with /pw)"
 else
     PW="${PW:-$(gen_pw)}" "$HH_DIR/lets-hack.sh" "$HH_USER"
 fi

hh/direnv-autostart/.gitignore

@@ -0,0 +1,3 @@
+# direnv local state — never commit. (The room password is generated in memory
+# at launch and never written to disk, so there is no secret file to ignore.)
+.direnv/

hh/direnv-autostart/setup.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# setup.sh — one-time setup for the hack-house direnv autostart ⛧
+# setup.sh — one-time setup for the hack-house direnv autostart
 #
 # Installs direnv (if missing), hooks your shell, and allows the .envrc in this
 # directory so that simply `cd`-ing here launches your hack-house session.
@@ -24,15 +24,15 @@ esac
 
 # 1. ensure direnv is installed
 if command -v direnv >/dev/null 2>&1; then
-    echo "⛧ direnv already installed ($(direnv version 2>/dev/null))"
+    echo "direnv already installed ($(direnv version 2>/dev/null))"
 elif command -v apt-get >/dev/null 2>&1; then
-    echo "⛧ installing direnv via apt…"
+    echo "installing direnv via apt…"
     sudo apt-get update -qq && sudo apt-get install -y direnv
 elif command -v brew >/dev/null 2>&1; then
-    echo "⛧ installing direnv via brew…"
+    echo "installing direnv via brew…"
     brew install direnv
 else
-    echo "⛧ installing direnv via the official script (→ ~/.local/bin)…"
+    echo "installing direnv via the official script (→ ~/.local/bin)…"
     mkdir -p "$HOME/.local/bin"
     export bin_path="$HOME/.local/bin"
     curl -sfL https://direnv.net/install.sh | bash
@@ -46,10 +46,10 @@ add_hook() { # $1 = rc file, $2 = hook line
     local rc="$1" line="$2"
     [[ -f "$rc" ]] || return 0
     if grep -qF 'direnv hook' "$rc"; then
-        echo "⛧ shell hook already present in $rc"
+        echo "shell hook already present in $rc"
     else
         printf '\n# direnv (hack-house autostart)\n%s\n' "$line" >> "$rc"
-        echo "⛧ added direnv hook to $rc"
+        echo "added direnv hook to $rc"
     fi
 }
 add_hook "$HOME/.bashrc" "$hook_line_bash"
@@ -62,8 +62,8 @@ if [[ ! -f "$HERE/.envrc" ]]; then
     exit 1
 fi
 direnv allow "$HERE"
-echo "⛧ allowed $HERE/.envrc"
+echo "allowed $HERE/.envrc"
 
 echo
-echo "⛧ done. open a new shell (or: source ~/.bashrc), then:  cd $HERE"
+echo "done. open a new shell (or: source ~/.bashrc), then:  cd $HERE"
 echo "  your single-user hack-house boots automatically (fresh server, generated password)."