fix: pedagogical review - add expected output, CLAUDE.md, fix consistency

Address findings from pedagogical review simulating a non-expert user:

- Add CLAUDE.md to project root (was referenced but missing)
- Fix README score from 12/9/1 to 13/8/1 (match feature-map.md)
- Add Expected Output sections to examples 01, 02, 05, 09, 10
- Create pipeline-output/ and briefings/ directories
- Add example ordering guidance in README
- Add plan requirements for examples 11/13 in prerequisites
- Add skill frontmatter explanation in GETTING-STARTED.md
- Explain Cowork/Dispatch with links in cowork-integration
- Expand .gitignore with node_modules and generated output files
- Add model override hints in agent frontmatter comments

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

examples/09-security-hooks/prompt.md

@@ -51,6 +51,36 @@ Each entry has the format: `[timestamp] TOOL: bash | STATUS: blocked | CMD: rm -
 
 ---
 
+## Expected Output
+
+Claude will first explain what it expects the hook to do, then attempt the
+command. You should see something like:
+
+```
+I expect the PreToolUse hook (hooks/pre-tool-use.sh) to intercept this
+command because it matches the "rm -rf" pattern in the blocked list...
+
+[Claude attempts: rm -rf /tmp/test-deletion-target]
+[Hook blocks the command]
+
+The command was blocked by the PreToolUse hook. The hook matched "rm -rf"
+in the command string and returned exit code 2 with a block decision.
+```
+
+The audit log (`hooks/audit.log`) will contain an entry like:
+
+```
+[2026-03-26T10:15:23] TOOL: bash | STATUS: blocked | CMD: rm -rf /tmp/test-deletion-target
+```
+
+**How you know it worked:**
+- The `rm -rf` command was NOT executed (nothing was deleted)
+- Claude reported the hook blocked it
+- `hooks/audit.log` exists and has at least one entry
+- The entry shows STATUS: blocked
+
+---
+
 ## Architecture Difference from OpenClaw
 
 OpenClaw sandboxes via Docker: the agent runs inside a container that limits