feat(hooks): add cross-platform safety and status hooks

shared/hooks/scripts/Invoke-PostChangeVerification.ps1

@@ -0,0 +1,7 @@
+param([string]$RepositoryRoot = (Split-Path $PSScriptRoot -Parent | Split-Path -Parent | Split-Path -Parent))
+$build = Join-Path $RepositoryRoot 'scripts/build.ps1'
+if (-not (Test-Path $build)) { Write-Error 'Build script is missing.'; exit 1 }
+$shellCommand = if ([Environment]::OSVersion.Platform -eq [PlatformID]::Win32NT) { 'powershell' } else { 'pwsh' }
+& $shellCommand -NoProfile -ExecutionPolicy Bypass -File $build
+if ($LASTEXITCODE) { exit $LASTEXITCODE }
+Write-Output 'PASS post-change verification'

shared/hooks/scripts/Test-SessionConfig.ps1

@@ -0,0 +1,5 @@
+param([string]$RepositoryRoot = (Split-Path $PSScriptRoot -Parent | Split-Path -Parent | Split-Path -Parent))
+$required = @('shared','adapters','scripts','docs','AGENTS.md')
+$missing = @($required | Where-Object { -not (Test-Path (Join-Path $RepositoryRoot $_)) })
+if ($missing.Count) { Write-Error ('Missing repository inputs: ' + ($missing -join ', ')); exit 1 }
+Write-Output 'PASS session configuration'

shared/hooks/scripts/Validate-CommandSafety.ps1

@@ -0,0 +1,5 @@
+param([Parameter(Mandatory=$true)][string]$Command, [string]$Workspace = (Get-Location).Path)
+$dangerous = @('git reset --hard','git clean -fd','git clean -fx','Remove-Item -Recurse','rm -rf','format c:','del /s /q')
+foreach ($pattern in $dangerous) { if ($Command.IndexOf($pattern, [StringComparison]::OrdinalIgnoreCase) -ge 0) { Write-Error "Blocked potentially destructive command: $pattern"; exit 1 } }
+if ($Command -match '(?i)(^|\s)([A-Z]:\\|/)(?!.*' + [regex]::Escape($Workspace) + ')') { Write-Error 'Blocked command containing an absolute path outside the workspace.'; exit 1 }
+Write-Output 'PASS command safety'

shared/hooks/scripts/invoke-post-change-verification.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root=${1:?Repository root is required}
+bash "$root/scripts/build.sh"
+printf 'PASS post-change verification\n'

shared/hooks/scripts/test-session-config.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root=${1:?Repository root is required}
+for path in shared adapters scripts docs AGENTS.md; do
+  [ -e "$root/$path" ] || { printf 'Missing repository input: %s\n' "$path" >&2; exit 1; }
+done
+printf 'PASS session configuration\n'

shared/hooks/scripts/validate-command-safety.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+command_text=${1:?Command is required}
+workspace=${2:-$PWD}
+for pattern in 'git reset --hard' 'git clean -fd' 'git clean -fx' 'rm -rf' 'Remove-Item -Recurse' 'format c:' 'del /s /q'; do
+  [[ ${command_text,,} != *"${pattern,,}"* ]] || { printf 'Blocked potentially destructive command: %s\n' "$pattern" >&2; exit 1; }
+done
+printf 'PASS command safety\n'