chore: CI badge, fix platform badge, .env.example, consistent frozen files, enable discussions, line count updates

Author: mcheemaa

.env.example

@@ -0,0 +1,22 @@
+# Specter CLI Configuration
+# Copy this file to .env.local and fill in your values:
+#   cp .env.example .env.local
+
+# Hetzner Cloud API Token (Read & Write)
+# Get one at: console.hetzner.cloud -> your project -> Security -> API Tokens
+HETZNER_CLOUD_TOKEN=
+
+# Cloudflare DNS API Token (Edit zone DNS permission)
+# Get one at: dash.cloudflare.com -> Profile -> API Tokens -> Create Token
+CLOUDFLARE_DNS_TOKEN=
+
+# Cloudflare Zone ID
+# Find at: dash.cloudflare.com -> your domain -> Overview -> right sidebar -> API section
+CLOUDFLARE_ZONE_ID=
+
+# SSH Key Name (as uploaded to Hetzner)
+# Upload at: console.hetzner.cloud -> Security -> SSH Keys
+HETZNER_SSH_KEY_NAME=
+
+# Your domain (must be on Cloudflare DNS)
+SPECTER_DOMAIN=

.github/PULL_REQUEST_TEMPLATE.md

@@ -5,7 +5,7 @@
 ## Does it modify any frozen files?
 
 <!-- Frozen files require 3 successful deploy tests before merging.
-     Frozen: systemd.go, deploy.go, image.go, cloudinit.go, hetzner/client.go, cloudflare/client.go -->
+     Frozen: systemd.go, cloudinit.go, caddyfile.go, image.go -->
 
 - [ ] No frozen files modified
 - [ ] Frozen files modified - 3 deploy test results attached below

.gitignore

@@ -2,5 +2,6 @@ bin/
 dist/
 *.exe
 .env*
+!.env.example
 .DS_Store
 *.log

CLAUDE.md

@@ -43,7 +43,7 @@ internal/
     systemd.go                  systemd unit template          [FROZEN]
     caddyfile.go                Caddy reverse proxy template   [FROZEN]
   tui/
-    app.go                      Main Bubbletea model (~900 lines)
+    app.go                      Main Bubbletea model (~1,300 lines)
     agent_list.go               Dashboard list view
     agent_detail.go             Agent detail panel
     deploy_form.go              Deploy form (huh v2)

CONTRIBUTING.md

@@ -95,7 +95,7 @@ These files are frozen. Do not modify them without running 3 full deploy cycles
 | `internal/templates/caddyfile.go` | Caddy handles TLS via ACME. Changing the template can trigger Let's Encrypt rate limits (10 registrations per IP per 3 hours). |
 | `cmd/specter/commands/image.go` | The image build provisioning script must call `sync` before snapshotting. Without it, Bun's 99MB binary was captured as 0 bytes. This was the Phase 3 blocker. |
 
-The 16/16 deploy success rate was hard-won. Every one of these files has a bug story behind it.
+The deploy success rate was hard-won. Every one of these files has a bug story behind it.
 
 ## How to Add a TUI View
 

README.md

@@ -6,8 +6,9 @@
 <p align="center"><em>AI agents that earn your trust.</em></p>
 
 <p align="center">
+  <a href="https://github.com/ghostwright/specter/actions/workflows/ci.yml"><img src="https://github.com/ghostwright/specter/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-blue.svg" alt="Apache 2.0 License"></a>
-  <img src="https://img.shields.io/badge/platform-Linux%20(x86)-black.svg" alt="Linux x86">
+  <img src="https://img.shields.io/badge/platform-macOS%20%26%20Linux-black.svg" alt="macOS & Linux">
   <img src="https://img.shields.io/badge/go-1.26-orange.svg" alt="Go 1.26">
   <img src="https://img.shields.io/badge/JSON-mode-green.svg" alt="JSON Mode">
 </p>
@@ -200,7 +201,7 @@ Your Machine                      Hetzner Cloud
 | specter CLI      |              | VM (Ubuntu 24.04)            |
 |                  | ---SSH--->   |                              |
 | Go binary        |              |   Caddy (auto-TLS)           |
-| ~3,500 lines     | --HTTPS-->   |   reverse_proxy :3100        |
+| ~8,000 lines     | --HTTPS-->   |   reverse_proxy :3100        |
 |                  |              |   specter-agent (Bun)        |
 +------------------+              |     /health -> JSON          |
        |                          |   Docker (sidecars)          |