chore: dev loop prompt rewrite + branch safety + tox conventions

- timmy-loop-prompt.md: full rewrite (76→209 lines) with PR-only workflow,
  tox environments, git hooks, Kimi dispatch safety block, conventional commits
- kimi-code skill: added Branch & Convention Safety section
- memories/MEMORY.md: updated with branch protection notes
- config.yaml: removed dead kimi API key
- cron/jobs.json: updated scheduled jobs
- channel_directory.json: minor update
- .gitignore: exclude queue/ and *.db

skills/autonomous-ai-agents/kimi-code/SKILL.md

@@ -81,3 +81,36 @@ process(action="wait", session_id="<id1>", timeout=180)
 5. **Background for long tasks** — use `background=true` + `process(action="wait")`
 6. **Parallel is fine** — run multiple Kimi processes across worktrees
 7. **Set timeout generously** — Kimi can take 1-3 minutes for complex tasks
+
+## Branch & Convention Safety (MANDATORY in every Kimi prompt)
+
+Kimi WILL push to main and run bare pytest if you don't tell it not to.
+Always include these constraints in EVERY Kimi prompt — copy verbatim,
+replacing {BRANCH} with the actual branch name:
+
+```
+GIT RULES — NON-NEGOTIABLE:
+- You are on branch '{BRANCH}'. Stay on it.
+- Do NOT checkout, merge, rebase, or push to main.
+- Commit your changes to THIS branch only.
+- Do NOT run 'git push'. The orchestrator handles pushing and PRs.
+- If tests fail, fix them here. Do not switch branches.
+
+TESTING:
+- Run tests with: tox -e unit
+- Do NOT run pytest directly. Always use tox.
+- Do NOT modify tox.ini, pyproject.toml, or CI config.
+
+CODE STYLE:
+- Ruff handles formatting. Do not manually format.
+- Run 'tox -e format' if you need to auto-fix style.
+- Follow existing patterns in the codebase.
+- No cloud dependencies. All AI runs on localhost via Ollama.
+- Never use innerHTML with untrusted content (XSS).
+- Never hardcode secrets. Use config.settings.
+```
+
+WHY: On 2026-03-14, Kimi pushed a broken commit directly to main because
+the prompt said "Commit when done" without branch constraints. This broke
+all active worktrees. Branch protection is now enforced on Gitea, but the
+prompt must also be explicit — defense in depth.