Git hooks

pre-commit scans the staged diff for obvious credential material (inbound API tokens sbk_..., plaintext password assignments in root .txt/.md additions) and blocks the commit if found (bypass a false positive with git commit --no-verify).

Opt in once with: git config core.hooksPath tools/hooks