Prevent the nested-repo accident, not just detect it; control the CSV check

Two corrections from an adversarial review of the previous commit. Both hold.

**The CI check fires too late.** It runs `on: push`, so a nested private clone
swept in by `git add -A` would already be on GitHub when the job goes red, and
deleting the branch would not remove it -- GitHub keeps `refs/pull/N/head`
permanently, which is why a sibling repository had to be deleted and recreated
rather than force-pushed. Detection after publication is not prevention.
Calling the previous commit a structural fix was wrong; it was a structural
alarm. `tools/pre-commit` is the half that prevents, with install instructions
and its own negative control in the header. `.git/hooks` is per-clone and not
committed, so the hook ships as a file to copy and CI remains the backstop for
anyone who has not installed it.

**The byte-identity check had no negative control.** It re-runs the extractor
and requires `data/labels.csv` to be unchanged -- which is trivially true if
the extractor were reading the CSV rather than the Markdown. The check would
then be green forever and catch nothing, the same vacuity as a proof whose
hypothesis is its conclusion. It now mutates a label in the Markdown source
and requires the check to fail, then restores and requires it to pass.

Both controls run, in both directions, before this commit: mutating
bandit-classification.md moves labels.csv and restoring it restores the file
byte-for-byte; the hook refuses a commit with a planted nested repository and
allows one without it.

The review also asked whether the accident happened in the tree the gate
covers. It did -- the private clone was inside this repository's worktree.
That was never the weak point; the timing was.

Author: espressolee

tools/pre-commit

@@ -0,0 +1,44 @@
+#!/bin/sh
+# Refuse a commit while a nested git repository is in the worktree.
+#
+# WHY THIS EXISTS AND WHY CI IS NOT ENOUGH
+#   2026-08-07: a clone of a PRIVATE repository sat in this worktree during an
+#   edit. `git add -A` would have committed it, and its history names an
+#   organisation under coordinated disclosure. It was caught by reading
+#   `git status` before staging -- attention, not a control.
+#
+#   The reproducibility workflow also checks for nested repositories, but it
+#   runs `on: push`. By the time it goes red the objects are already on
+#   GitHub, and deleting a branch does not remove them: GitHub keeps
+#   `refs/pull/N/head` permanently, which is why the WarmLogic staging repo had
+#   to be deleted and recreated rather than force-pushed. Detection after
+#   publication is not prevention. This hook is the half that prevents.
+#
+# INSTALL (per clone -- .git/hooks is not committed)
+#   cp tools/pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
+#
+# NEGATIVE CONTROL -- run both before trusting it
+#   1. mkdir -p x/.git && git commit --allow-empty -m t   -> expect REFUSED
+#   2. rm -rf x     && git commit --allow-empty -m t      -> expect a commit
+#   A gate that has only been seen to allow has not been tested.
+#
+# `--no-verify` bypasses this, deliberately: the failure being prevented is the
+# accidental one.
+
+set -eu
+
+nested=$(find . -mindepth 2 -name .git -not -path './.git/*' -print 2>/dev/null || true)
+if [ -n "$nested" ]; then
+  printf '%s\n' \
+    'REFUSED: a nested git repository is in this worktree.' \
+    '' \
+    "$nested" \
+    '' \
+    'A clone left here can be swept in by `git add -A`. If it is a clone of a' \
+    'private repository, that publishes it -- and the objects survive a later' \
+    'branch delete via refs/pull/N/head.' \
+    '' \
+    'Move it out of the worktree, or commit explicit paths with --no-verify if' \
+    'you genuinely mean to keep it here.' >&2
+  exit 1
+fi