feat: install-hook — the v0.0.1 promise, three milestones late (#8)

[hermanngeorge15]

Closes #8 (HOOK-01). This is the POC: install the hook, try to commit a poisoned CLAUDE.md, get blocked.

$ injection-scanner install-hook
Installed pre-commit hook at .git/hooks/pre-commit.
Staged files are scanned before each commit; High and above block it.

$ git commit -m "update spec"
./docs/CLAUDE.md
  :3 CRITICAL  Attempts to override agent instructions  (PI001)

Commit blocked: prompt-injection patterns at high or above.
Explain a finding with: injection-scanner explain <PI0XX>
Commit anyway with:     git commit --no-verify

60ms on a 40-file repository, against the 200ms budget the original v0.0.1 criteria set.

Three things a naive hook gets wrong

It would scan the working tree. The hook scans the staged blob via git show :path, so a partially staged file is judged on what's actually about to be committed. Otherwise you stage a clean version, leave the payload unstaged, and pass. Has its own test.

It would report the staging copy's path. Findings must name ./docs/CLAUDE.md, not /tmp/tmp.XXXX/docs/CLAUDE.md — a path that no longer exists by the time the developer reads it. Solved by running the scan from inside the staging copy rather than string-editing the output.

It would clobber an existing hook. A pre-commit hook is often the only thing between a repository and a committed secret. A foreign hook is refused with a pointer to --force; our own is recognised by a marker line and updated rather than erroring.

Hook location comes from git, not from assuming .git/hooks

It reads core.hooksPath and --git-common-dir. Both assumptions break on a worktree, where .git is a file pointing elsewhere, and on any repo with a shared hooks directory.

Depends on #21

--fail-on defaults to high here rather than the CLI's low, so MEDIUM heuristics inform without blocking a commit. That default only became meaningful with the severity rebalance — before it, every finding was CRITICAL or HIGH and the hook would have blocked on everything.

Also ships .pre-commit-hooks.yaml

Both entry points are needed, not one: pre-commit install overwrites the plain git hook this command writes, so a team using the framework would silently lose it.

repos:
  - repo: https://github.com/UnityInFlow/injection-scanner
    rev: v0.0.3
    hooks:
      - id: injection-scanner

Tests

7 new, driving real git commit against real repositories — the block, the clean pass, the repository-path assertion, the foreign-hook refusal, reinstall-is-not-an-error, the partially-staged case, and manifest validity. Full suite 24 binaries green, clippy clean.