fix: sync engineering practices on prepare, not postinstall

[therockstorm]

Summary

#428 added postinstall: node --run sync-ai-rules. groundcrew is published to public npm, so every consumer install would run npm exec @clipboard-health/engineering-practices@latest: an E404 for most, and for anyone with a Clipboard NPM_TOKEN, it would write .rules/ and AGENTS.md into node_modules/@clipboard-health/groundcrew. No release has shipped it yet.

This moves the sync to prepare, which npm runs for local installs (npm install, npm ci) but not when installing from the registry.

Merge Danger

Two-way. Must merge before the next feat: or fix: release.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: cf0ef7bf-100f-4403-871e-03a0f9c69173

---

📥 Commits

Reviewing files that changed from the base of the PR and between af1edd6 and 23469ce.

---

📒 Files selected for processing (1)

• package.json

---

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• ClipboardHealth/cbh-core (manual)

---

Limit details: You’ve used the included review currently available. Your 62 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

---

📝 Walkthrough

Walkthrough

The package scripts no longer run sync-ai-rules through postinstall. The prepare script now runs husky followed by sync-ai-rules.

Changes

Install lifecycle

Layer / File(s)	Summary
Prepare script configuration package.json	The prepare script runs husky followed by sync-ai-rules. The postinstall script is removed.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Suggested reviewers: paulbaranowski

---

Merge Risk: ⚪ Minimal · up to 23469

The sync moves to prepare, while the package allowlist excludes its generated files from the published tarball. No material merge-blocking risk is established.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes moving the engineering-practices sync from postinstall to prepare.
Description check		The description explains the postinstall problem, the prepare change, and the expected effect on registry consumers and local installs.

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}