v3.2.1

Fixes

doc-drift no longer costs ~1.3s at the end of every turn. It runs as a Stop hook, so
its cost is paid continuously — this release cuts it to ~0.04s. Two independent causes,
neither of them the actual drift scan (~20ms):

• Diff-base resolution was ~85% of a warm run. docDriftDiffBase re-ran
  ClosestBase on every invocation — a merge-base plus a rev-list per
  integration-branch candidate, a dozen git subprocesses — to recompute a value that
  only changes when HEAD moves. It is now memoized per (repo, HEAD) alongside the
  existing nag marker under $XDG_STATE_HOME/docgraph/doc-drift. A stale memo fails
  safe: it can only go stale when an integration branch advances while HEAD stays put,
  and the remembered base is then an ancestor of the true one — a superset diff, so
  doc-drift over-reports rather than missing drift.
• The loop guard now short-circuits before the diff rather than after it. Once a HEAD
  has been nagged, every remaining path returns 0, so the base resolution, diff and doc
  greps were pure waste. Exit codes are unchanged by construction.

Installs now absorb the first-exec code-signature assessment. On macOS a freshly
written binary has a new cdhash, so its first exec blocks in dyld for a live Gatekeeper
assessment — ~1.0s for this binary, versus ~0.03s warm. Every rebuild therefore re-armed
that ~1s toll on the next turn's Stop hook. All install paths now exec the new binary
once to absorb it while you are already waiting on the build: install.sh and
/docgraph:install already did so incidentally for the version string, and just install
now does too. All three are annotated as load-bearing, since the tempting cleanup is to
drop an exec that reads as a cosmetic smoke test.

Measured in this repo: warm 0.13s → 0.03s; first run after a rebuild 1.10s → 0.04s.

Behaviour, exit codes and CLI surface are unchanged — this is purely a cost fix.

Docs

• CLAUDE.md carries the cold-exec mechanism as a footgun, and its runDocDrift
  description tracks the new state-file helpers.