[FIX] REVIEWED-131: build PENDING-165 (d) as an allowlist, then (b) narrowly

(d) — governance-drift-check.py now DECLARES the contents of ~/dotfiles/git/hooks
(README.md, pre-commit) and reports anything unexpected or declared-but-missing.
Tracked-ness is never consulted, and that is the correction: the filed form tested
"neither tracked nor pre-commit", and 066a47a was TRACKED for four weeks, so it
would have been silent throughout the only occurrence that did damage. Asserted
structurally, not in prose — a control checks that scan_hooks' code names contain
neither "git" nor "subprocess".

(b) — .gitignore for the four git-lfs shim names. DELIBERATELY NARROW: a blanket
git/hooks/* + allowlist would silently prevent committing a new legitimate hook,
which would work locally, never reach the repo, and be invisible to (d) because
(d) reads the filesystem and not the index. Verified the pair composes: a planted
shim yields 0 entries in git status AND is reported UNEXPECTED by the check.

⚠ And a fifth self-referential instrument event, in the fix for that very class.
The five new controls were appended after failed_controls is computed (702 vs
846): all ran, none counted, tally still read 48/48, and a failure among them
would have printed NOTHING. The check against blind checks was blind to itself.
Caught by comparing the printed tally to the number of controls added. Moved above
the report block (53/53) and verified by breaking one deliberately and confirming
it prints INSTRUMENT NOT VERIFIED and names itself.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NvZAKSf9aqratbqHbU9LK5

.gitignore

@@ -4,3 +4,22 @@ __pycache__/
 
 # macOS Finder droppings
 .DS_Store
+
+# git-lfs shims in the GLOBAL hook directory (REVIEWED-131 / PENDING-165 option (b))
+# git-lfs installs these into whatever core.hooksPath names; here that is the hook
+# directory shared by every repo on this machine. On 2026-03-20 a routine `git add`
+# captured them (066a47a) and they sat TRACKED for four weeks, executing everywhere and
+# indistinguishable from hooks the steward wrote. Ignoring them stops that capture.
+#
+# ⚠ DELIBERATELY NARROW — these four names only, not `git/hooks/*` with an allowlist.
+# A blanket ignore would silently prevent committing a NEW legitimate hook: it would work
+# locally, never reach the repo, and the allowlist check cannot see that (it reads the
+# filesystem, not the index). A narrow ignore trades away nothing.
+#
+# Visibility is NOT lost by this: governance-drift-check.py declares the directory's
+# contents and reports anything unexpected, tracked-ness not consulted. That check is
+# what makes ignoring safe — do not ignore more than this without extending it.
+git/hooks/pre-push
+git/hooks/post-checkout
+git/hooks/post-commit
+git/hooks/post-merge