docs: update documentation for debian-configuration repo rename

- Root README.md: new, describes overall repo layout (proxmox/, pihole/,
  scripts/) and secret-scanning workflow
- Root CLAUDE.md: new, cross-section guardrails and instructions for
  adding new machine types; references proxmox/CLAUDE.md and pihole/
  section-specific rules
- pihole/README.md: new, covers scripts usage, notable DHCP/PXE config,
  EFI VM requirements (VirtIO RNG, Secure Boot), and secrets handling
- proxmox/README.md: add repo-context note pointing back to root README

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s

README.md

@@ -0,0 +1,46 @@
+# debian-configuration
+
+Configuration, hardening toolsets, and operational docs for Wayne's
+Debian-based LAN machines. Each subdirectory covers a different host or
+service type.
+
+## Layout
+
+```
+proxmox/   Proxmox VE hosts (pve1 production, pve-test sandbox)
+pihole/    Pi-hole DNS/DHCP (config snapshots, pull/apply scripts)
+scripts/   Repo-wide scripts (secret scanning, git hook installer)
+```
+
+## Sections
+
+### `proxmox/`
+
+Base configuration and hardening toolset for Proxmox VE hosts. See
+`proxmox/README.md` for goals, quick-start, and current status.
+
+### `pihole/`
+
+Pi-hole v6 configuration management. Stores a sanitised snapshot of the
+live config and provides scripts to pull from or push to a running
+instance. See `pihole/README.md` for usage.
+
+## Secret scanning
+
+All commits are scanned for secrets by a CI pipeline that runs on both
+GitHub Actions and Gitea Actions. The same scan can be run locally:
+
+```bash
+# One-time setup — installs a pre-commit git hook
+bash scripts/install-hooks.sh
+
+# Manual run against the full git history
+bash scripts/check-secrets.sh
+
+# Requires gitleaks on PATH; falls back to Docker if available
+# https://github.com/gitleaks/gitleaks#installing
+```
+
+`pihole/pull-config.sh` automatically redacts sensitive fields
+(`pwhash`, `totp_secret`, `app_pwhash`) from `pihole.toml` before
+writing it to disk, so the repo stays clean by default.