feat(studio): daily Today-Hero proposal pipeline (v0.31.0)

Cross-store research (Apple, Play, Steam, Docker, VS Code,
Chrome Web Store, Flathub) consistently rewards editorial
curation over algorithmic recommendations — but manual
copywriting per release does not survive a solo-dev cadence.
This commit lands a daily-build pipeline so the Today-Hero
card stays fresh without operator hand-edits per release.

Pipeline shape (full design in docs/today-pipeline.md):

1. tools/today/collect.sh aggregates "what happened in the
   last 24 hours" across the F∆I monorepos: git log per repo,
   store-index seed.yaml diffs, architecture/system-gaps doc
   changes, Studio release tags, and (opt-in) audit-log
   highlights. Outputs plain text.

2. tools/today/propose.sh feeds the signal summary plus
   prompt.template.md to the operator's already-configured
   System-AI (Ollama default; OpenAI-compatible endpoints
   work via env-var override). Drafts N candidate stories as
   YAML files under ~/.fai/today/proposals/<date>/.

3. tools/today/accept.sh validates a chosen candidate against
   the today/v1 schema and the no-marketing-speak banned-word
   list, then atomic-renames it into ~/.fai/today/active.yaml.

4. Studio reads active.yaml at store-page init via the new
   TodayStoryLoader (lib/data/today_story_loader.dart). On any
   failure (file missing, schema mismatch, banned-words hit,
   parse error) it falls back to the compiled-in
   _kFallbackTodayStory so KRITIS deployments and fresh
   installs always render something sensible.

Trust + audit:
- All proposed and accepted stories live as plain YAML on disk.
- The pipeline calls only the operator's already-configured
  System-AI; it never reaches a CMS, never phones home, works
  air-gapped if the System-AI does.
- The bash accept gate AND the Dart loader both enforce the
  banned-word list — a hand-edited active.yaml that bypassed
  the shell still won't reach the UI.
- Removing the cron entry disables the pipeline; Studio falls
  back to the const story and continues to work.

Cron / launchd / systemd recipes documented in
tools/today/README.md.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

tools/today/collect.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# tools/today/collect.sh
+#
+# Aggregates "what happened in the last N hours" across the F∆I
+# monorepos into a single plain-text summary the proposer feeds
+# to the System-AI.
+#
+# Touches only git history and the bundled store-index seed file.
+# Does not read the audit log without --with-audit.
+set -euo pipefail
+
+SINCE="${FAI_TODAY_SINCE:-24 hours ago}"
+
+# Walk every fai-* directory next to fai_studio so the collector
+# works from any of the sibling checkouts. Adjust here if the
+# layout ever changes.
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+
+emit_section() {
+  printf '\n## %s\n\n' "$1"
+}
+
+emit_section "RECENT COMMITS (last: $SINCE)"
+for repo in "$ROOT"/fai_*/; do
+  [ -d "$repo/.git" ] || continue
+  name="$(basename "$repo")"
+  log=$(git -C "$repo" log --since="$SINCE" --pretty='%h %s' 2>/dev/null || true)
+  if [ -n "$log" ]; then
+    printf '### %s\n%s\n\n' "$name" "$log"
+  fi
+done
+
+emit_section "STORE INDEX SEED CHANGES"
+seed="$ROOT/fai_platform/crates/fai_hub/store-index/seed.yaml"
+if [ -f "$seed" ] && [ -d "$ROOT/fai_platform/.git" ]; then
+  diff=$(git -C "$ROOT/fai_platform" log --since="$SINCE" --oneline -- \
+    crates/fai_hub/store-index/seed.yaml 2>/dev/null || true)
+  if [ -n "$diff" ]; then
+    printf '%s\n' "$diff"
+  else
+    printf '(no changes in window)\n'
+  fi
+fi
+
+emit_section "ARCHITECTURE / SYSTEM-GAPS CHANGES"
+arch_dir="$ROOT/fai_platform/docs"
+if [ -d "$arch_dir" ] && [ -d "$ROOT/fai_platform/.git" ]; then
+  changes=$(git -C "$ROOT/fai_platform" log --since="$SINCE" --oneline -- \
+    docs/architecture docs/advanced 2>/dev/null || true)
+  if [ -n "$changes" ]; then
+    printf '%s\n' "$changes"
+  else
+    printf '(no changes in window)\n'
+  fi
+fi
+
+emit_section "STUDIO RECENT RELEASES"
+studio="$ROOT/fai_studio"
+if [ -d "$studio/.git" ]; then
+  tags=$(git -C "$studio" log --since="$SINCE" --pretty='%h %s' \
+    --grep='^feat(studio)\|^chore(studio): bump' 2>/dev/null || true)
+  if [ -n "$tags" ]; then
+    printf '%s\n' "$tags"
+  else
+    printf '(no Studio release activity)\n'
+  fi
+fi
+
+emit_section "AUDIT-LOG HIGHLIGHTS"
+if [ "${FAI_TODAY_WITH_AUDIT:-0}" = "1" ] && command -v fai >/dev/null 2>&1; then
+  fai audit recent --limit 20 2>/dev/null | head -40 || \
+    printf '(audit query failed; daemon may be stopped)\n'
+else
+  printf '(audit pull disabled — set FAI_TODAY_WITH_AUDIT=1 to opt in)\n'
+fi