migrate to the new tiered structure

example/README.md

@@ -0,0 +1,28 @@
+# Example: a Ruby + Postgres project
+
+A filled-in `.safeclaude/` for a typical Rails-style app — Ruby (via rbenv), the
+Postgres client, and headless Chrome for browser tests. It's here as a reference
+you can copy from when setting up your own project.
+
+## How to use it
+
+- **Start fresh, then borrow:** run `safeclaude init` in your project for a blank
+  starter, then copy whatever pieces you need from here. (Recommended — you only
+  pull in what applies to you.)
+- **Copy the whole thing:** `cp -r .../safeclaude/example/.safeclaude ~/your-project/`
+  and tweak from there.
+
+## What's where
+
+| File | When it runs | What it does |
+| --- | --- | --- |
+| `.safeclaude/Dockerfile` | once, then cached | installs system packages, sets up Chrome and the Ruby/Node version managers |
+| `hooks/10-ruby.sh` | each launch | installs the project's Ruby and bundler (skips if already done) |
+| `hooks/20-bundle.sh` | each launch | runs `bundle install`, but only when `Gemfile.lock` changed |
+| `hooks/30-pg-proxy.sh` | each launch | lets the app reach the host's Postgres at the usual `127.0.0.1:5432` |
+| `hooks/15-node.sh.example` | off by default | optional Node setup — rename to `15-node.sh` to turn on |
+| `.env.example` | — | copy to `.env` for a private gem token (kept out of git) |
+
+The pattern to take away: slow, one-time installs go in the **Dockerfile** so
+they're cached; anything that needs your code or has to stick around between
+runs goes in a **hook**.