feat(hooks): wave-1 guards -- approval ask, plan gate, test lock, post-edit check

Wave-1 order 4 (P7, P12, the P9 test lock, the P3 plan-approval guard).
All command hooks; none runs a model.

- P12: pre-bash-executor answers permissionDecision "ask" before merge
  into main, push, tag/publish and destructive git (holds in auto mode).
  post-approval-log writes exactly what the person was asked to the K2
  approval log: merge/push to main as `merge`, tag/publish as `release`,
  with a one-hour expiry; nothing when no person was asked.
- P3: pre-plan-gate runs the K3 plan gate on a Voyage plan leaving plan
  mode and sends a refused plan back; "not measured" asks, never passes.
- P9: lib/util/test-lock.mjs (K8). pre-write-executor refuses edits to
  locked test files; stop-test-lock refuses "done" for the locking
  session (stop_hook_active guarded).
- P7: post-edit-check runs the target repo's own formatter/linter per
  edit, only during a Voyage plan run or after opt-in
  (.claude/voyage-guards.json); lib/verification/step-check.mjs (K9) fails
  the step on findings; no tool reads "not measured", never green.
- STORM cap matcher also names `Agent` (the tool's name since 2.1.63).
- Mod precondition stated in README, SECURITY.md and every PreToolUse stop
  guard: Voyage's guards are deterministic only when no installed mod
  handles `tool.check`.

K2, K3 and K5 are stubbed in tests until orders 2 and 3 are merged.
Two independent review rounds; every finding has a regression test.
Suite 1600 (1598 pass / 0 fail / 2 skipped).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -52,6 +52,18 @@ Full flag reference for each command (modes, `--gates`, `--profile`, breaking ch
 > pre-registered measurement in `docs/storm-measurement.md` — decline is a
 > no-op, adopt is one constant.
 
+> **Guards (P3/P7/P9/P12).** Command hooks only, wired for every session.
+> `pre-bash-executor` answers `ask` (holds in auto mode) before merge into
+> main, push, tag/publish and destructive git; `post-approval-log` writes
+> approvals to the K2 log. `pre-plan-gate` runs the K3 plan gate on a Voyage
+> plan leaving plan mode. `pre-write-executor` + `stop-test-lock` enforce the
+> K8 test lock (`lib/util/test-lock.mjs`). `post-edit-check` runs the target
+> repo's own format/lint only during a Voyage plan run or after opt-in
+> (`.claude/voyage-guards.json`); `lib/verification/step-check.mjs` (K9) fails
+> the step on findings. A missing contract CLI reads "not measured"/"not
+> logged", never green. Voyage's guards are deterministic only when no
+> installed mod handles `tool.check`.
+
 ## Agents
 
 | Agent | Model | Role |