Add hook-based safety harness

[wnstfy]

Priority: Medium

Problem: Wrapper/docs fixes help, but agent misuse should be blocked before tool execution.

Acceptance:

• Pre-use hook flags high-risk xCloud calls and requires confirmation.
• Redaction hook blocks tokens, PEM private keys, passwords, and magic-login URLs from output.
• Pre-commit hook rejects new unsafe curl -v, --data-raw secret examples, plaintext base URLs, and shell JSON interpolation.