v3.2.3

• CLAUDE.md § Safety-Critical Rules gains two rules found in the 2026-10-02 Stage 3 trials. No live calls on placeholder credentials: a scaffold teammate had sent one request to api.stripe.com with a fake key while writing tests; the scaffold lead now also tells every teammate so at spawn. A hook refuses to stage a file: a secret guard blocked .env.local.example; the stage now leaves it uncommitted and lists it in the report instead of working around the hook