Harden loop patterns and OSS maintenance

[MPIsaac-Per]

What changed

• Harden structured command execution with timeouts, safe argument handling, explicit error codes, and correct output tails.
• Replace the verification shell implementation with a tested Python gate using atomic, collision-resistant evidence records.
• Make evidence checks and the Stop hook use the newest run only, structured hook decisions, background-task handling, and reentrancy protection.
• Add prompt-cache validation plus a locked toolchain, regression tests, contributor and security policy files, release guidance, issue forms, Dependabot, CI, CodeQL, dependency review, and OpenSSF Scorecard.

Why

The original examples could accept stale evidence, duplicate pytest phase records, lose shell argument boundaries, and return ambiguous Stop-hook output. Those edge cases undermine the completion guarantees the patterns teach.

Impact

Each pattern now has executable tests and explicit failure behavior. Readers can copy examples with the safeguards already present.

Validation

• 37 pytest tests passed
• 83.71% branch coverage
• Ruff, formatter, mypy, shellcheck, and pip-audit passed
• actionlint passed
• zizmor pedantic online audit passed with zero findings

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.