[AAASM-3943] ✨ (scripts): Add bootstrap script for org AI config

[Chisanan232]

Jira Ticket

• AAASM-3943

Summary

• Adds scripts/bootstrap-ai-workspace.sh, a pure local bash script that installs the org AI baseline (CLAUDE.md, AGENTS.md, .claude/rules/, .claude/skills/) from this repo into a contributor's local multi-repo workspace root, per the layout defined in .claude/WORKSPACE.md (AAASM-3939).
• Depends on [AAASM-3939] 📝 (workspace): Add org-level AI workspace layout doc #25 and [AAASM-3940] ✨ (docs): Add org-level CLAUDE.md and AGENTS.md baseline #26. Branched from [AAASM-3940] ✨ (docs): Add org-level CLAUDE.md and AGENTS.md baseline #26's ancestor rather than [AAASM-3941] ✨ (rules): Add org-level .claude/rules for AI-assisted development #27/[AAASM-3942] ✨ (skills): Add reusable org-level skill files #28 (AAASM-3941/3942) since the script only needs the .claude/rules and .claude/skills directory paths, not their contents.

Changes

• scripts/bootstrap-ai-workspace.sh: symlinks (not copies, so upstream edits are picked up without re-running) the four org baseline artifacts into a target workspace root; creates the workspace root folder structure if missing; supports --dry-run; never clobbers an existing file/symlink at the target that isn't already the expected symlink back to this repo (reported as skipped (local override)); prints a per-item report plus created/updated/skipped/failed summary counts; set -euo pipefail, no network calls, no eval, exits non-zero on any failure.
• scripts/README.md: documents usage, --dry-run, what skipped (local override) means and how to force a re-install, and reserves a section for the not-yet-built validate-ai-workspace.sh (AAASM-3944).

Validation

• Content reviewed for accuracy
• Links verified
• No unintended scope changes

Manual local testing (see PR description below for detail):

• --dry-run against a nonexistent path made zero filesystem changes and printed the correct planned actions.
• A real run against a fresh temp directory created the workspace root, .claude/, .claude/commands/, and all four symlinks; exit code 0.
• Re-running against the same directory reported everything as skipped (up to date) with created=0 updated=0 — confirms idempotency.
• Replacing an installed symlink with a real local file and re-running left it untouched and reported skipped (local override).
• Pointing an installed symlink at a now-nonexistent path (simulating a moved/re-cloned .github checkout) and re-running relinked it automatically, reported as updated.
• Removing a source directory before running caused that one item to report failed and the script to exit non-zero, while unrelated items still completed — confirms partial-failure reporting and the non-zero exit gate.
• No-argument invocation prints usage and exits non-zero.

Checklist

• PR title follows: [<ticket ID>] <GitEmoji> (<change scope category>): <key point as summary>
• PR body follows this template

[Chisanan232]

Claude Code review — AAASM-3943

CI: Red, same org-wide Actions billing-block (see #25) — not caused by this change.

Scope vs ticket: Matches AAASM-3943's AC. I read scripts/bootstrap-ai-workspace.sh directly (not just the implementer's self-report): set -euo pipefail, no network calls, no eval, all paths quoted, realpath-based comparison so a moved/re-cloned checkout still counts as up to date, never clobbers a target that isn't the exact expected symlink (reported as local override), broken symlinks are self-healed rather than silently left, non-zero exit on any failure. This is a security-sensitive script (writes symlinks based on a user-supplied path) and it's written defensively.

Side effects: None on existing functionality — net-new script, only writes into a workspace-root path the caller supplies; never touches files inside this repo or any other repo.

Caveat (expected, not a defect): run in isolation on just this branch, ensure_symlink for .claude/rules/.claude/skills will report failed: source does not exist since those directories only exist once #27/#28 are also merged — this is correct behavior for a stacked PR, already exercised end-to-end via a disposable local merge in #31.

Frontend: N/A.

Recommend: ready to merge, after #26.