v0.2.0 - always-on hooks, real deps, and the honest null benchmark

D Strange v0.2.0.

What's new:

• Always-on hook. A UserPromptSubmit hook (hooks/inject-ruleset.mjs, Node built-ins only, no network / secrets / spawn) makes the method available on every prompt in Claude Code. On every other supported agent, install is still just copying files.
• Real, declared dependencies. commander, js-yaml, zod at runtime plus vitest for tests. v0.1's zero-execution / zero-dependency posture is retracted in-repo and replaced by an honest one: one small auditable hook, and a declared, Dependabot-monitored dependency graph.
• checkHookSafety gate, a mode system (lite / full / ultra / off), and an uninstall script.
• A hash-locked benchmark harness (benchmarks/) and grounding-lint, a standalone linter that exits non-zero on any uncited claim.

Gates: 25 tests pass, validator OK, npm audit 0 vulnerabilities, semgrep 237 rules / 0 findings.