v0.58.0

Five practices this project has followed all along and the skill never taught. Found by diffing what
the repository does against what the skill says — a pass now written into CONTRIBUTING.md,
because the mechanism is worth more than this batch.

• A committed hook is inert. Git does not populate .git/hooks/ from a tracked directory. The
  ladder proposed commit hooks without saying so, which produces a control that exists in the tree,
  fires on nobody's machine, and that everyone believes is running.
• --no-verify needs a stated convention rather than a pretence it will not happen.
• Local-only checks must skip when CI is set, or they teach people the gate is noise.
• A gate script runs on more than one machine's tooling; a portability failure looks like a broken
  check.
• permissions: {} is the floor worth proposing, not contents: read — a job added later starts
  closed rather than inheriting a token nobody re-examined.