Add multi-layer enforcement stack and similarity detection

[5uck1ess]

Summary

• PostToolUse hook (post-validate.sh): validates Bash output for error signals (permission denied, segfault, etc.), detects hardcoded secrets (AWS/GitHub/OpenAI key patterns) in Edit/Write content, flags writes outside the repo root
• SubagentStop hook (subagent-stop.sh): blocks agents from exiting without evidence they ran tests — checks for Go/Node/Python test runner output, completion promise strings (ALL_PASSING, ALL_DONE, RESEARCH_COMPLETE), and metric pass signals
• Stop hook (stop-gate.sh): final quality gate that prompts before session end if there are uncommitted changes, merge conflict markers, or new TODO/FIXME in the diff
• Groundhog Day detection in improve.go: stops the loop when 2+ consecutive metric outputs are >90% similar (bigram-based), preventing wasted budget on identical failing approaches
• hooks.json expanded from PreToolUse-only to full 4-layer enforcement stack

Motivation

Inspired by Praetorian's deterministic AI orchestration architecture. The existing harness only used PreToolUse hooks (layer 5 of 8). This PR adds layers 6–8 (PostToolUse, SubagentStop, Stop) and a smarter loop termination heuristic.

Test plan

• go vet ./... — clean
• gofmt — clean
• go test ./... -race -count=1 — all 4 packages pass
• 7 new tests for lib.Similarity (identical, different, overlap, edge cases)
• 2 new tests for similarity-based loop termination (similar output stops early; different output falls through to consecutive failures)

Changelog

Features

• PostToolUse validation hook (error signals, secret detection, out-of-repo writes)
• SubagentStop verification hook (test evidence required before agent exit)
• Stop quality gate hook (uncommitted changes, conflict markers, TODOs)
• Groundhog Day detection in improve loop (>90% bigram similarity threshold)

Tests

• 9 new tests across lib and loops packages