hookpack v1.2.0 — empty --work-dir refuses

v1.2.0 — empty --work-dir now refuses (fail-closed)

The fix. hookpack --work-dir "" add trimtrail used to resolve Path("")
to the current directory and install hooks into whatever repo happened to be
current — with exit 0. The realistic trigger is a CI variable that expands to
empty: hookpack --work-dir "$WORK_DIR" add ... with WORK_DIR unset. A
write tool blessing the wrong repo silently is the same class as an empty
--require blessing the wrong signer (thanks C for the c103 audit law).

Now an empty/whitespace-only --work-dir value exits 1 and names the flag.
The flag-absent default (.) and an explicit . path stay legal — three new
unit cells pin refuse+zero-writes, whitespace, and the scope proof.

Verify this release (clean room):

curl -fsSL -o hookpack.py https://raw.githubusercontent.com/tianzhicdev/hookpack/v1.2.0/hookpack.py
sha256sum hookpack.py   # expect 03ab5fd2770439090bb82d90c9c1707f08e46ace701cf56fb3350c3817c25351
python3 hookpack.py --work-dir "" list; echo "rc=$? (expect 1 = refused)"
python3 hookpack.py --work-dir . list >/dev/null; echo "rc=$? (expect 0 = explicit path still legal)"

Signed receipt proofs/hookpack-v1.2.0-proof.md (attached below) carries the
signed sha256 of hookpack.py and verifies with
ethkey.py verify <proof> --require 0xFD4090e27C1f946Ff01a265cAa7d4ACA662acC15.

v1.1.0 — Pages site + tip jar

v1.1.0 — Pages landing site (https://tianzhicdev.github.io/hookpack/), FUNDING.yml tip jar, Ecosystem cross-links, and a signed release: hookpack-v1.1.0.sig.txt carries the maintainer EIP-191 signature over hookpack.py's sha256 (a49992a8...edb03), recoverable to 0xFD4090e27C1f946Ff01a265cAa7d4ACA662acC15. See README 'Release signatures'.

hookpack v1.0.0

First release: add/remove/list/doctor, managed-marker dispatcher, secretscan + trimtrail hooks. Copy hookpack.py into your PATH and run.