Restore test suite and fix safety-checks to be configurable

- Restore all test files (README.md, VERIFICATION.md, test-framework.sh, unit tests)
- Restore config-loader.sh script that was missing
- Make safety-checks.sh configurable using UPSTREAM_ORG and YOUR_GITHUB_USER variables
- Add backward compatibility aliases (block_upstream_*, check_upstream_repo)
- Fix sync-upstream.sh to skip push prompt when branch is already up-to-date
- All 19 tests now passing (13 config-loader + 6 safety-checks)

Author: jmjava

.env-template

@@ -0,0 +1,44 @@
+# Configuration Template for embabel-learning scripts
+# Copy this file to .env and customize it for your environment
+#
+# Usage:
+#   cp .env-template .env
+#   # Edit .env with your actual values
+#
+# The .env file is ignored by git (contains in .gitignore)
+
+# Your personal GitHub username. Used for forking, cloning, and identifying your contributions.
+# This is YOUR username (e.g., "alice", "bob", "your-username")
+# Your forks will be at: github.com/YOUR_GITHUB_USER/repo-name
+#
+# Note: This is your personal username, NOT your organization name.
+# If you have a personal org (e.g., "menkelabs"), that's separate from YOUR_GITHUB_USER.
+YOUR_GITHUB_USER=your-username
+
+# The GitHub organization whose repositories you want to MONITOR and learn from.
+# This is for PRODUCTION use - the organization you want to monitor.
+# Examples: "embabel", "spring-projects", "apache", "kubernetes", etc.
+# The scripts will monitor this organization's repos, not YOUR organization's repos.
+UPSTREAM_ORG=embabel
+
+# Optional: GitHub organization to use for TESTING only.
+# If set, test scripts will use this instead of UPSTREAM_ORG.
+# This is safer for testing since it uses your own organization.
+# Leave empty or unset to use UPSTREAM_ORG for tests as well.
+# Example: TEST_UPSTREAM_ORG=menkelabs
+TEST_UPSTREAM_ORG=
+
+# The base directory where your GitHub repositories are cloned.
+# Default: $HOME/github/${YOUR_GITHUB_USER}
+BASE_DIR=$HOME/github/${YOUR_GITHUB_USER}
+
+# A space-separated list of repository names to monitor daily.
+# These should be repos you have cloned under $BASE_DIR.
+# Example: MONITOR_REPOS="guide embabel-agent dice"
+MONITOR_REPOS=guide embabel-agent
+
+# Workspace name for VS Code/Cursor workspace file
+WORKSPACE_NAME=${UPSTREAM_ORG}-workspace
+
+# Maximum number of repos to auto-detect if MONITOR_REPOS is not set
+MAX_MONITOR_REPOS=10

.pre-commit-config.yaml

@@ -2,12 +2,31 @@
 # See https://pre-commit.com for more information
 
 repos:
-  # GitGuardian - Secret scanning
+  # GitGuardian - Secret scanning (runs on both commit and push)
   - repo: https://github.com/GitGuardian/ggshield
     rev: v1.25.0
     hooks:
       - id: ggshield
         language_version: python3
+        stages: [pre-commit, pre-push]  # Run on both commit and push for extra security
+
+  # Local safety checks - Prevent commits to upstream organization repos
+  - repo: local
+    hooks:
+      - id: block-upstream-commit
+        name: Block commits to upstream organization
+        entry: bash -c 'REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" && if [ -z "$REPO_ROOT" ]; then exit 0; fi && SCRIPT_DIR="$REPO_ROOT/scripts" && LEARNING_DIR="$REPO_ROOT" && if [ -f "$SCRIPT_DIR/config-loader.sh" ]; then source "$SCRIPT_DIR/config-loader.sh" >/dev/null 2>&1; fi && if [ -f "$SCRIPT_DIR/safety-checks.sh" ]; then source "$SCRIPT_DIR/safety-checks.sh" >/dev/null 2>&1 && block_upstream_commit; else exit 0; fi'
+        language: system
+        pass_filenames: false
+        always_run: true
+        stages: [pre-commit]
+      - id: block-upstream-push
+        name: Block pushes to upstream organization
+        entry: scripts/block-upstream-push-hook.sh
+        language: system
+        pass_filenames: false
+        always_run: true
+        stages: [pre-push]
 
   # General file checks
   - repo: https://github.com/pre-commit/pre-commit-hooks