feat(studio): daily Today-Hero proposal pipeline (v0.31.0)

Cross-store research (Apple, Play, Steam, Docker, VS Code,
Chrome Web Store, Flathub) consistently rewards editorial
curation over algorithmic recommendations — but manual
copywriting per release does not survive a solo-dev cadence.
This commit lands a daily-build pipeline so the Today-Hero
card stays fresh without operator hand-edits per release.

Pipeline shape (full design in docs/today-pipeline.md):

1. tools/today/collect.sh aggregates "what happened in the
   last 24 hours" across the F∆I monorepos: git log per repo,
   store-index seed.yaml diffs, architecture/system-gaps doc
   changes, Studio release tags, and (opt-in) audit-log
   highlights. Outputs plain text.

2. tools/today/propose.sh feeds the signal summary plus
   prompt.template.md to the operator's already-configured
   System-AI (Ollama default; OpenAI-compatible endpoints
   work via env-var override). Drafts N candidate stories as
   YAML files under ~/.fai/today/proposals/<date>/.

3. tools/today/accept.sh validates a chosen candidate against
   the today/v1 schema and the no-marketing-speak banned-word
   list, then atomic-renames it into ~/.fai/today/active.yaml.

4. Studio reads active.yaml at store-page init via the new
   TodayStoryLoader (lib/data/today_story_loader.dart). On any
   failure (file missing, schema mismatch, banned-words hit,
   parse error) it falls back to the compiled-in
   _kFallbackTodayStory so KRITIS deployments and fresh
   installs always render something sensible.

Trust + audit:
- All proposed and accepted stories live as plain YAML on disk.
- The pipeline calls only the operator's already-configured
  System-AI; it never reaches a CMS, never phones home, works
  air-gapped if the System-AI does.
- The bash accept gate AND the Dart loader both enforce the
  banned-word list — a hand-edited active.yaml that bypassed
  the shell still won't reach the UI.
- Removing the cron entry disables the pipeline; Studio falls
  back to the const story and continues to work.

Cron / launchd / systemd recipes documented in
tools/today/README.md.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

tools/today/accept.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# tools/today/accept.sh <proposal-path>
+#
+# Validates the chosen candidate, then atomically swaps it in as
+# ~/.fai/today/active.yaml. Studio reads that file at startup.
+set -euo pipefail
+
+if [ "${1:-}" = "" ]; then
+  printf 'Usage: %s <path-to-candidate.yaml>\n' "$0" >&2
+  exit 1
+fi
+
+src="$1"
+[ -f "$src" ] || { printf 'No such file: %s\n' "$src" >&2; exit 1; }
+
+# Schema gate. Block accept if the candidate is missing required
+# top-level keys or carries the wrong schema version. Studio
+# would silently fall back, but we want a loud failure here so
+# the operator knows the proposal was malformed.
+require_key() {
+  local key="$1"
+  if ! grep -qE "^$key:" "$src"; then
+    printf 'Reject: candidate is missing key `%s`.\n' "$key" >&2
+    exit 2
+  fi
+}
+
+if ! grep -qE '^schema:[[:space:]]*today/v1[[:space:]]*$' "$src"; then
+  printf 'Reject: candidate must declare `schema: today/v1`.\n' >&2
+  exit 2
+fi
+
+for k in badge_en badge_de title_en title_de body_en body_de icon cta; do
+  require_key "$k"
+done
+
+# Banned-words check (matches both DE and EN bodies/titles).
+banned='viral|killer|powerful|just[[:space:]]+works|revolutionary|game-changing|seamless|next-generation|cutting-edge|world-class|unprecedented'
+if grep -qiE "$banned" "$src"; then
+  printf 'Reject: candidate contains banned marketing language.\n' >&2
+  printf 'Hits:\n' >&2
+  grep -niE "$banned" "$src" >&2 || true
+  exit 3
+fi
+
+# Atomic move via copy-then-rename so Studio never reads a torn
+# half-written file even if it polls during the swap.
+dst="$HOME/.fai/today/active.yaml"
+mkdir -p "$(dirname "$dst")"
+tmp="$(mktemp "${dst}.XXXXXX")"
+cp "$src" "$tmp"
+mv "$tmp" "$dst"
+
+printf 'Accepted: %s\n  → %s\n' "$src" "$dst"
+printf 'Restart Studio (or wait for the next launch) to see it.\n'