[megamen32]

What changed

Keeps the simple scan / publish UX while making the defaults safer.

Transactional publish

• captures the exact target branch SHA before sanitizing
• uses explicit --force-with-lease=<ref>:<sha> instead of blind --force
• refuses to overwrite concurrent target updates
• verifies the remote SHA after push
• re-clones and scans targets under 100 MiB; larger repos get SHA verification without the extra clone
• never force-overwrites tags

Hooks

• guard and auto-publish can coexist in one managed pre-push dispatcher
• existing user hooks are preserved and chained
• disabling the last managed action restores the original hook

CI reports

• scan --format json
• publish --scan --format json
• guard run --format json

Backup/restore

• removes the hardcoded project-specific restore path
• restore instructions now use the actual source gitdir

Validation

• 55 tests pass
• warnings treated as errors
• python -m py_compile passes
• git diff --check passes
• real local source→target publish verified end-to-end, including lease push, remote SHA check, independent re-clone and tree equality