Guards

Before docker compose up|start|restart on a ~/infra service, checks that Tailscale is Running and that the service's BIND_IP matches the Tailscale IPv4; otherwise refuses the command with the fix.

Enforces the personal wiki's edit rules at tool-call time: raw/ is immutable, log.md is append-only, public pages never wikilink local-only pages, and git commit waits for bin/wikilint.