S56: spawn template overhaul + system-wide README push + .gitkeep cleanup (#129)

- Spawn template system rebuilt: regenerate-registry command (3-pass ID matching),
  registry 26→41 files, generate_branch_meta fixed, Phase 0 snapshot added
- System-wide push: 12/12 branches updated (227 additions, 0 errors)
- READMEs added to all standard directories across 15 branches
- .claude/settings.local.json tracked system-wide (deny rules)
- 35 .gitkeep files removed (replaced by READMEs)
- Bypass files updated across 13 branches
- Bugs fixed: manager citizen_class crash, backup rglob performance

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/aipass/cli/.aipass/README.md

@@ -0,0 +1,3 @@
+# Branch Prompt
+
+AI context for `CLI`. The `aipass_local_prompt.md` file is injected every turn, telling the AI who you are and how to work in your branch.

src/aipass/cli/.claude/README.md

@@ -0,0 +1,5 @@
+# Claude Code Settings
+
+Claude Code configuration for `CLI`.
+
+Contains `settings.local.json` with permission rules. Most branches are denied raw git commands and must use `drone @git` instead.

src/aipass/cli/.claude/settings.local.json

@@ -0,0 +1,28 @@
+{
+  "permissions": {
+    "allow": [],
+    "deny": [
+      "Bash(git reset*)",
+      "Bash(git rebase*)",
+      "Bash(git merge*)",
+      "Bash(git config*)",
+      "Bash(git push --force*)",
+      "Bash(git push -f *)",
+      "Bash(git checkout -- *)",
+      "Bash(git checkout .*)",
+      "Bash(git restore --staged*)",
+      "Bash(git restore .*)",
+      "Bash(git clean*)",
+      "Bash(git branch -D*)",
+      "Bash(git stash drop*)",
+      "Bash(git stash clear*)",
+      "Bash(rm -rf*)",
+      "Bash(rm -r *)",
+      "Bash(git checkout -b*)",
+      "Bash(git commit*)",
+      "Bash(git push*)"
+    ],
+    "ask": []
+  },
+  "enabledMcpjsonServers": []
+}

src/aipass/cli/.seedgo/README.md

@@ -0,0 +1,5 @@
+# Standards Bypass
+
+Seedgo audit bypass config for `CLI`.
+
+When an audit flags a false positive that doesn't apply to your architecture, add a bypass entry in `bypass.json` with a reason explaining why it's justified.

src/aipass/cli/.seedgo/bypass.json

@@ -73,12 +73,12 @@
     "example": {
       "file": "apps/modules/logger.py",
       "standard": "cli",
+      "reason": "Circular dependency - logger cannot import CLI",
       "lines": [
         146,
         177
       ],
-      "pattern": "if __name__ == '__main__'",
-      "reason": "Circular dependency - logger cannot import CLI"
+      "pattern": "if __name__ == '__main__'"
     },
     "fields": {
       "file": "Relative path from branch root (required)",
@@ -88,4 +88,4 @@
       "reason": "Required - why this bypass exists"
     }
   }
-}
+}

src/aipass/cli/apps/README.md

@@ -0,0 +1,8 @@
+# Apps
+
+Application layer for `CLI`.
+
+- `cli.py` — Entry point. Auto-discovers and routes commands to modules.
+- `modules/` — Business logic and orchestration. One module per command.
+- `handlers/` — Implementation details. Called by modules, never by CLI directly.
+- `plugins/` — Scheduled tasks and extensions.

src/aipass/cli/apps/handlers/README.md

@@ -0,0 +1,5 @@
+# Handlers
+
+Implementation details for `CLI`.
+
+Handlers do the actual work. They are called by modules, never directly by the CLI. Keep business logic in modules, implementation in handlers.

src/aipass/cli/apps/modules/README.md

@@ -0,0 +1,5 @@
+# Modules
+
+Business logic for `CLI`. One module per command.
+
+Modules orchestrate work by calling handlers. They are the public API of the branch — drone routes commands here.

src/aipass/cli/apps/plugins/README.md

@@ -0,0 +1,5 @@
+# Plugins
+
+Scheduled tasks and extensions for `CLI`.
+
+Plugins are standalone units of work that can be scheduled via the daemon. Each plugin handles one specific recurring task.

src/aipass/cli/templates/README.md

@@ -0,0 +1,5 @@
+# Templates
+
+Branch-specific templates for `CLI`.
+
+Any templates this branch provides to the system or uses internally. Examples: plan templates (flow), trinity templates (memory), test templates (seedgo).

src/aipass/cli/tests/README.md

@@ -0,0 +1,6 @@
+# Tests
+
+Pytest unit tests for `CLI`.
+
+- `conftest.py` — Shared fixtures (temp dirs, mocks, sample data).
+- `test_*.py` — Test files. Standard tests cover JSON handler, CLI routing, and error resilience. Custom tests cover branch-specific domain logic.