Guardrails for AI Coding Assistants

Practical hooks, worktree guards, and workflow rules I added after near-misses with AI coding assistants reading secrets and editing wrong branches