v0.6.0 — Hook-driven graph freshness: the graph builds and stays current on its own

The dependency graph no longer depends on anyone calling the MCP server.

The gap this closes: hook-only installs scored graphless forever if no MCP call ever built the graph — and a graph built at session start went stale as the agent edited imports. Either way, the structural blast-radius signal ("8 modules import this") silently degraded to pattern-matching exactly when it mattered.

What's new:

• SessionStart hook spawns a detached background process that cold-builds the graph, off the command path.
• Every PreToolUse refreshes the graph incrementally before scoring — a stat fast-path (mtime+size, no reads) makes a no-op refresh ~20 ms, and centrality is only recomputed when something actually changed. Verdicts always score against the current tree.
• Lockfile coordination (.blast-scope/graph.lock): concurrent sessions never double-build; a contended refresh is skipped, never waited on; stale locks from crashed builders self-break.
• Graph-context honesty: assessments carry graph_context: true/false, and a high/critical advisory produced while the cold build is still running says "no dependency graph yet" instead of presenting a blind verdict as an informed one.
• The Claude Code plugin now registers both hooks; python -m blast_scope.hook dispatches on the event.

Full flow documented in docs/hook.md.