v0.2.0 — pre-commit, SARIF, GitHub Action

Adds the workflow integrations the deterministic tier was missing: a pre-commit hook, SARIF
output for GitHub code scanning, and a staged-files fast path. No new checks; the check
library is unchanged at 332. The default output format is still JSON, so the skill is
unaffected.

Added

• Pre-commit hook. .pre-commit-hooks.yaml ships two hooks — git-gud-security
  (scans staged files, blocks the commit on high+ findings) and git-gud-security-warn
  (same scan, warn-only). Point .pre-commit-config.yaml at the repo and pre-commit install. Answers the most-asked question: yes, it hooks into pre-commit.
• --staged. Scans only files staged for commit (git diff --cached), so the
  pre-commit path stays fast on big repos. Falls back to a whole-tree scan with a notice
  when git isn't present. Committed and unstaged changes are out of scope by design.
• --fail-on {critical,high,medium,low}. Exits nonzero when a finding at or above the
  given severity is present, so a hook or CI step can block. Opt-in: findings are
  candidates, so the default still exits 0.
• --format {json,sarif,text}. sarif emits SARIF 2.1.0 (one rule per check id,
  security-severity set) for the GitHub Security tab and inline PR annotations; text is
  a terse human summary for the pre-commit path. json stays the default; --json is kept
  as an alias.
• Per-engine SARIF runs. SARIF output is split into one run per engine — deterministic
  (this script) and llm (the skill's dataflow/adversarial findings) — each with its own
  automationDetails.id (git-gud-security/deterministic, git-gud-security/llm), so GitHub
  renders them as distinct analyses and CI can gate them independently (hard-fail deterministic,
  warn on single-pass llm). Every finding now carries an engine field in JSON too. The
  standalone script only produces deterministic findings, so today that's a single run.
• GitHub Action. A reusable composite action (action.yml) so a repo gets a CI scan with
  SARIF upload by adding uses: kidsmeal/git-gud-security@v0.2.0 to a workflow. Annotates by
  default (findings are candidates); fail-on: blocks. Inputs passed via env, never
  interpolated into the run script, to avoid the Actions expression-injection hole this tool
  itself flags.
• ROADMAP.md — direction and the deterministic-vs-LLM architectural line.
• docs/pre-install-gate.md — spec for the 0.3.0 headline: vetting a third-party skill /
  MCP / plugin from a URL before it's installed.

Tests

• SARIF validity (result-per-finding, 1-based regions, rules present), --fail-on exit
  codes (blocks when dirty, passes when clean, never blocks without the flag), and
  --staged scope (a throwaway git repo proves only staged files are scanned).