Guards

Supply-chain gate: vets npm/pnpm/yarn/bun installs against the registry before they run

Puts tsc, linter and secret-scan diagnostics in the result of every Edit and Write, so Claude fixes what it broke in the same turn