fix: move prepare lifecycle hook to explicit setup-hooks script

npm's prepare hook runs on every `npm install` in any environment,
causing the package to silently install git hooks into any consumer's
repository without their explicit consent. This is unexpected behavior
for a plugin package consumed by end users.

Rename prepare to setup-hooks so contributors can opt in explicitly by
running `npm run setup-hooks` after cloning, as now documented in
CONTRIBUTING.md.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Author: claude[bot]

CONTRIBUTING.md

@@ -31,6 +31,17 @@ PRs may receive AI-assisted reviews (Copilot, Claude, Gemini, Codex) at the owne
 
 ## Before You Start
 
+### First-Time Setup
+
+After cloning the repo, install git hooks manually:
+
+```bash
+npm install
+npm run setup-hooks
+```
+
+The `setup-hooks` script installs pre-commit and pre-push hooks into your local `.git/hooks/`. It does **not** run automatically on `npm install` — you must opt in.
+
 ### Multi-File Changes
 
 For changes touching multiple files, **read the relevant checklist first**:

package.json

@@ -38,7 +38,7 @@
     "detect": "node bin/dev-cli.js detect",
     "verify": "node bin/dev-cli.js verify",
     "version": "node scripts/stamp-version.js && git add -A",
-    "prepare": "node bin/dev-cli.js setup-hooks"
+    "setup-hooks": "node bin/dev-cli.js setup-hooks"
   },
   "repository": {
     "type": "git",