#2258 feat(factory): manage Droid settings from dotfiles

Summary

• manage Factory Droid model selection through models.json hydration
• install shared security, push, GitHub-settings, secret, and git-ai hooks
• remove legacy Droid hook entries during activation while preserving unrelated Factory settings

Validation

• jq JSON validation
• Bash syntax and ShellCheck
• fresh and legacy Factory activation merge tests
• git diff --check
• make build

---

Summary by cubic

Manage Factory Droid model and guardrail hooks from dotfiles, merging them into Factory settings without overwriting user preferences. Adds a local Gemma preset, sets it as default, and makes activation idempotent while cleaning legacy entries and writing atomically.

• New Features
  • Merge managed model and hooks into ~/.factory/settings.json with jq, preserving other settings and removing legacy Droid hooks, duplicate managed hooks, and stale importedClaudeHooks refs.
  • Add a local Gemma model preset and set it as default; values sourced from models.json via config/factory/settings.tpl.json and hydrated by scripts/llm-update.sh.
  • Install shared guardrails: security, block git push, block GitHub settings, secret scan, and git-ai checkpoints on PreToolUse/PostToolUse for write/edit with correct Execute/Edit matchers.
  • Run the merge during Home Manager activation via config/factory/default.nix using activate-settings.sh; idempotent, uses a temp file, and sets chmod 600 for safer writes.