Add best-practices library, knowledge distillation pipeline settings, and first session log

- best-practices/: 11 topic files + INDEX.md extracted from cluster-bootstrap
  and custom-claude-skills (validation, k8s, helm, ansible, secrets, debugging, etc.)
- settings.yaml: pipeline config (log retention, tracked projects, max logs per run)
- CLAUDE.md: updated with best-practices loading and pipeline documentation
- memory/log/: first session log demonstrating the format

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

best-practices/scripting.md

@@ -0,0 +1,29 @@
+# Scripting Conventions
+
+## Structure
+
+- All scripts live in `scripts/` and run from the repository root
+- Scripts should be idempotent and safe to re-run
+- Exit non-zero on failure so `&&` chains work naturally
+
+## Verification Scripts
+
+- Automated checks confirming milestone or feature outcomes
+- Use colour output (green/red) for pass/fail indicators
+- Should be non-destructive and environment-resilient
+- Avoid needing sudo — test from the accessible side of a connection instead
+- Check for default/insecure credentials and print remediation instructions on failure
+- Use `curl --resolve` to bypass DNS/proxy layers when testing direct connectivity
+
+## Automation Triggers
+
+If you run the same 3+ commands in sequence more than once, it should become a script. Look for:
+- Repeated command sequences in conversation history
+- Steps requiring careful ordering
+- Multi-step manual processes that are error-prone
+
+## Shell Gotchas
+
+- `((PASS++))` fails under `set -e` when PASS=0 — the expression evaluates to 0 (false), triggering errexit. Use `PASS=$((PASS + 1))` instead.
+- Always quote variables in conditionals and file paths
+- Use `trap` for cleanup of temp files and credentials