feat(studio): daily Today-Hero proposal pipeline (v0.31.0)

Cross-store research (Apple, Play, Steam, Docker, VS Code,
Chrome Web Store, Flathub) consistently rewards editorial
curation over algorithmic recommendations — but manual
copywriting per release does not survive a solo-dev cadence.
This commit lands a daily-build pipeline so the Today-Hero
card stays fresh without operator hand-edits per release.

Pipeline shape (full design in docs/today-pipeline.md):

1. tools/today/collect.sh aggregates "what happened in the
   last 24 hours" across the F∆I monorepos: git log per repo,
   store-index seed.yaml diffs, architecture/system-gaps doc
   changes, Studio release tags, and (opt-in) audit-log
   highlights. Outputs plain text.

2. tools/today/propose.sh feeds the signal summary plus
   prompt.template.md to the operator's already-configured
   System-AI (Ollama default; OpenAI-compatible endpoints
   work via env-var override). Drafts N candidate stories as
   YAML files under ~/.fai/today/proposals/<date>/.

3. tools/today/accept.sh validates a chosen candidate against
   the today/v1 schema and the no-marketing-speak banned-word
   list, then atomic-renames it into ~/.fai/today/active.yaml.

4. Studio reads active.yaml at store-page init via the new
   TodayStoryLoader (lib/data/today_story_loader.dart). On any
   failure (file missing, schema mismatch, banned-words hit,
   parse error) it falls back to the compiled-in
   _kFallbackTodayStory so KRITIS deployments and fresh
   installs always render something sensible.

Trust + audit:
- All proposed and accepted stories live as plain YAML on disk.
- The pipeline calls only the operator's already-configured
  System-AI; it never reaches a CMS, never phones home, works
  air-gapped if the System-AI does.
- The bash accept gate AND the Dart loader both enforce the
  banned-word list — a hand-edited active.yaml that bypassed
  the shell still won't reach the UI.
- Removing the cron entry disables the pipeline; Studio falls
  back to the const story and continues to work.

Cron / launchd / systemd recipes documented in
tools/today/README.md.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

tools/today/README.md

@@ -0,0 +1,73 @@
+# Today-Hero proposal tooling
+
+Daily-build pipeline for the editorial Today-Hero card in Studio's store.
+See `../../docs/today-pipeline.md` for the full design rationale.
+
+## Quick start
+
+```bash
+# 1. Generate today's proposals (calls the local Ollama by default).
+./propose.sh
+
+# 2. Skim them — they sit under ~/.fai/today/proposals/<ISO-DATE>/
+ls ~/.fai/today/proposals/
+
+# 3. Accept one. The chosen file becomes ~/.fai/today/active.yaml,
+#    which Studio reads at startup.
+./accept.sh ~/.fai/today/proposals/2026-05-08/candidate-2.yaml
+
+# 4. Restart Studio (or let the next launch pick it up).
+```
+
+## Schedule it
+
+### macOS — launchd
+
+```bash
+# Drop a plist that runs propose.sh every morning at 07:30 local time.
+# `launchctl load ~/Library/LaunchAgents/ai.flemming.fai.today.plist` to
+# install. The plist must point at the absolute path of propose.sh.
+```
+
+A starter plist lives at `launchd/ai.flemming.fai.today.plist`.
+
+### Linux — systemd timer
+
+```bash
+# Copy systemd/fai-today.{service,timer} into ~/.config/systemd/user/,
+# then `systemctl --user enable --now fai-today.timer`.
+```
+
+### Anywhere — cron
+
+```cron
+30 7 * * * /Users/flemming/.../tools/today/propose.sh > /tmp/fai-today.log 2>&1
+```
+
+## Provider override
+
+`propose.sh` defaults to Ollama at `http://127.0.0.1:11434` with the model
+`gemma3:4b`. Override via env vars:
+
+| Variable          | Default                          | Example                                         |
+|-------------------|----------------------------------|-------------------------------------------------|
+| `FAI_TODAY_API`   | `http://127.0.0.1:11434/api/generate` | `https://api.openai.com/v1/chat/completions` |
+| `FAI_TODAY_MODEL` | `gemma3:4b`                      | `gpt-4o-mini`                                   |
+| `FAI_TODAY_KEY`   | (unset)                          | `$OPENAI_API_KEY`                               |
+| `FAI_TODAY_N`     | `3`                              | `1` (single shot)                               |
+
+OpenAI-compatible endpoints will work as long as they speak `chat/completions`
+or `generate`; the script auto-detects from the URL path.
+
+## Trust model
+
+- Reads only `git log`, `git diff`, and the bundled `seed.yaml` of
+  installed F∆I monorepos. Never your audit log without explicit op-in.
+- Calls only the System-AI you've already configured for Studio. The same
+  privacy mode you set there applies here.
+- Writes only into `~/.fai/today/`. Nothing in `~/.fai/data/` or
+  `~/.fai/config.yaml` is touched.
+- Studio loads `active.yaml` at startup; if the file is missing or fails
+  schema validation, the compiled-in fallback story renders. KRITIS
+  fresh installs see the fallback until and unless an operator accepts a
+  proposal.