v3.25.0

• Pre-commit gate now actually blocks: scan --staged runs a staged scan and exits non-zero on critical findings (it was silently passing before).
• Fewer false positives and clearer output: declared popular packages and first-party source dirs are no longer flagged as hallucinated; --format errors on unsupported combos instead of silently emitting markdown; diff auto-detects the base branch.
• Docs corrected (CVE count, per-category rule table, dependency note) with new guards to prevent drift. +20 regression tests.