fix(hooks): idempotent portable git-hook installer + pre-commit branch-guard (#11598)

[mrveiss]

Thinking Path

Issue #11598: git-hook enforcement silently dead — core.hooksPath pinned to an absolute path, pre-push a dangling symlink into a deleted worktree, no pre-commit at all. Documented protected-branch/worktree-only enforcement inactive.

What Changed

• New scripts/install-git-hooks.sh: idempotent, machine-portable (derives paths from git rev-parse --show-toplevel/--git-common-dir), installs REAL hook files (not worktree symlinks), normalizes a bad core.hooksPath back to default, detects+replaces dangling symlinks, backs up unmanaged hooks.
• New tracked tools/git-hooks/pre-commit template (main/master branch-guard, reuses canonical block logic from framework hook, inlined to be standalone).
• Old tools/git-hooks/install_hooks.sh (the symlink footgun) now a thin shim that execs the new installer — no code deleted.
• Docs pointer in CLAUDE_GIT.md.

Verification

Recreated the exact #11598 bug in a throwaway repo (absolute core.hooksPath + dangling pre-push symlink), ran the installer, attempted git commit on main → hook printed "COMMIT BLOCKED" and commit returned exit 1 (no commit created); master also blocked; Dev_new_gui/issue-* allowed (exit 0). Second installer run = no-op (idempotent). Main tree's live hooks and global git config untouched.

Model Used

Opus 4.8

Closes #11598

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!