Add project hooks guarding invariants, main, and hotRun contention

[solcott]

Summary

Four hooks in .claude/settings.json, each backed by a script in .claude/hooks/. The existing ktfmt and /verify-reminder hooks are unchanged. Hook messages point at the .claude/rules/ files from #42.

Hook	When	What it does
guard-invariants.sh	Before Write/Edit	Asks before an edit adds fallbackToDestructiveMigration(, rememberSaveableBackStack(, an iosX64 target, or kotlin-parcelize. The prompt gives the reason and the rule file.
guard-main-branch.sh	Before Bash	Denies git commit/git push while on main, or a push targeting main from any branch.
warn-hotrun-race.sh	Before Bash	Warns when a ./gradlew run starts while :desktopApp:hotRun --auto is running. That continuous build makes concurrent builds fail with errors in untouched modules.
check-build-credentials.sh	Session start	Warns if MEALDB_API_KEY or gpr.user/gpr.key (or GITHUB_ACTOR/GITHUB_TOKEN) is missing. It checks presence only and never prints a value.

Notes:

• The invariant check asks rather than denies, so a deliberate change to one of these rules is still possible.
• It matches call and plugin syntax, not names. The KDoc in BrowserHistoryEffect.web.kt that mentions rememberSaveableBackStack passes.
• The credential check mirrors the build's own lookup: ProjectExt.kt for the API key, settings.gradle.kts for GitHub Packages.
• hotMcpServer, which compiles nothing, does not trigger the hotRun warning.
• A forced "route every Gradle call through the runner agent" hook was left out, because it would also fire inside that agent.

Test plan

• Invariant check: fed every tracked .kt/.kts/.toml file through it, and none were flagged; synthetic Room and iosX64 edits prompt as expected
• Main-branch guard: denies on main, origin main, HEAD:main, -C dir … main and compound commands; allows feature branches, maintenance, and commit messages that mention main (a false positive during development, now fixed)
• hotRun warning: fires in a live session against a decoy hotRun --auto process; silent without one and for hotRun/reload themselves
• Credential check: silent with credentials configured; lists both missing items with an empty HOME
• Start a new session on this branch and confirm no credential warning appears on a configured machine

🤖 Generated with Claude Code