feat: add block-no-verify hook to prevent git hook bypass

[tupe12334]

Summary

• Adds block-no-verify@1.1.2 as a PreToolUse hook in .claude/settings.json to block git commands that attempt to bypass hooks
• Documents the git hook safety policy in Agents.md under a new "Git Hook Safety" section

Problem

The current .claude/settings.json has PreToolUse hooks for Task — but nothing prevents an agent from using the bypass flags on git commit or git push, which silently skips all pre-commit/pre-push hooks (tests, linting, secret scanning, etc).

Solution

block-no-verify is a purpose-built hook that reads Claude Code's PreToolUse stdin payload and exits non-zero if it detects:

• The --no-verify flag on any git subcommand
• The -n shorthand on git commit
• A core.hooksPath override pointing to /dev/null

Zero configuration — just add it as a Bash PreToolUse hook.

Changes

.claude/settings.json  — add block-no-verify Bash PreToolUse hook
Agents.md              — add Git Hook Safety section

Test plan

• Run git commit normally — should pass through
• Run git commit with bypass flags — should be blocked with a clear message
• Verify Agents.md renders cleanly in GitHub

Closes #202