Populate best practices from claude-foundations

Migrates 20 topic files from claude-foundations/best-practices/ to this
standalone repo. Adds BESTPRACTICES.md index, CLAUDE.md conventions, and
updated README.md. Container agents clone this repo to /best-practices.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

BESTPRACTICES.md

@@ -0,0 +1,26 @@
+# Best Practices Index
+
+Generalised best practices extracted from real project work via the `/distill-best-practices` skill. Each topic file is self-contained — read only the files relevant to the current project.
+
+## Topics
+
+- [Validation & Deployment](validation.md) — Validate locally, deploy once; full-chain testing; pre-flight checks
+- [Security Architecture](security-architecture.md) — Server boundary rule: no credential crosses to the client; proxy + identity mapping pattern; defense in depth; anti-patterns
+- [Secrets Management](secrets-management.md) — SOPS + age, credential handling, file naming, encryption gotchas
+- [Git & Source Control](git-source-control.md) — Commit practices, GitOps workflows, remote conventions
+- [Kubernetes Patterns](kubernetes.md) — Volume mounts, deployment strategies, naming, bootstrap ordering
+- [Helm Charts](helm.md) — Schema validation, version verification, values structure
+- [Ansible](ansible.md) — Inventory, templates, idempotency, credential safety
+- [Scripting](scripting.md) — Shell conventions, verification scripts, idempotency, colour output
+- [Documentation Standards](documentation.md) — CLAUDE.md, MEMORY.md, FUTURE.md, README.md structure and tiered memory
+- [Milestones & Reflections](milestones.md) — Milestone workflow, verification, reflection process
+- [Debugging Methodology](debugging.md) — Systematic diagnosis, full-chain testing, common pitfalls
+- [Claude Code Skills](skills-development.md) — Skill authoring, context injection, tool restrictions
+- [Linting & Formatting](linting.md) — Tool choices per language, PostToolUse hook, pre-commit integration, formatter contract
+- [Spec-Driven Development](spec-driven-development.md) — Spec structure, requirement numbering, test-first workflow, context tiers, anti-patterns
+- [Test-Driven Development](test-driven-development.md) — Edge case discovery, property-based testing, mutation testing, AI agent testing patterns, test architecture
+- [Networking & Infrastructure](networking.md) — nftables safety, systemd socket activation, Docker forwarding, TLS SNI vs Host header, wildcard certs
+- [Docker UID Matching](docker-uid-matching.md) — UID wrapper entrypoint for mounted volumes, gosu pattern, when to use vs K8s securityContext
+- [Database Selection](database-selection.md) — SQLite is not a production database; always use PostgreSQL for services with FQDNs, multiple consumers, or concurrent access
+- [Docker](docker.md) — gosu PID 1, GIT_SSH_COMMAND scope, slim image health checks, buildx local images, default users, TTY flags, UID resolution
+- [Octopus Process Templates](octopus-process-templates.md) — OCL syntax, step template references, channel scoping, parameters, versioning, Platform Hub patterns