feat(gitflow): hooks in every repo, no per-project step

Global: `make link` generates githooks/ from lib/gitflow.sh and sets git's
global core.hooksPath to ~/.claude/githooks, so every repo on the machine
runs the pre-commit protection and the post-commit / post-merge push, even
one that never ran gitflow init. A repo's own local core.hooksPath still
wins, so hooks/session-start.sh calls `gitflow reconcile-hooks` once per
session and rewrites a .githooks/ that lags the lib (LRN-114 automated);
the pre-commit exemption now covers .githooks/** next to .claude/**.

Per-repo opt-outs for a foreign clone: `git config gitflow.protect false`
(branch model) and `git config gitflow.autopush false` (push). Both, and
the GIT_CONFIG_GLOBAL= / GIT_CONFIG= env bypass, are static deny rules.

`make test` and the two suites that commit on main export
GIT_CONFIG_GLOBAL=/dev/null so the machine's global hooks never fire in
throwaway repos. doctor gains "Git hooks" (global setting, githooks/ equal
to the emitters) and "Scratchpad" (warn when TMPDIR sits on a tmpfs with
usrquota: systemd caps each user at 80% of it, which killed two shells
today, BLK-021). Tests: T18h, T19d, T20 (reconcile), T21 (whitelist and
protect opt-out); this repo's own stale .githooks/ refreshed.

hooks/session-start.sh

@@ -44,6 +44,17 @@ else
 fi
 unset _lib
 
+# ── gitflow hooks reconcile (BDR-095) ──
+# A repo's .githooks/ lags lib/gitflow.sh until someone re-runs install-hook
+# (LRN-114). Do it here, once per session, silently when current; the lib
+# prints the refreshed names, shown in the banner with a commit reminder.
+GF_REFRESHED=""
+_gf_lib="$(dirname "${BASH_SOURCE[0]}")/../lib/gitflow.sh"
+if [ -f "$_gf_lib" ] && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  GF_REFRESHED=$(bash "$_gf_lib" reconcile-hooks 2>/dev/null | sed -n 's/^gitflow hooks refreshed: *//p')
+fi
+unset _gf_lib
+
 # ── Toggle plugin detection ──
 
 TOGGLE_ACTIVE=()
@@ -199,6 +210,11 @@ unset _active_count _inactive_count
 printf "│  🖥️  CLI : %-40s│\n" "$GSD_STATUS"
 [ -n "$TOKEN_WARN" ] && printf "│  💰 %-44s│\n" "${TOKEN_WARN:0:44}"
 printf "│  📦 v%-45s│\n" "$CONFIG_VERSION"
+if [ -n "$GF_REFRESHED" ]; then
+  _gf_line="hooks refreshed: $GF_REFRESHED → commit .githooks/"
+  printf "│  🪝 %-44s│\n" "${_gf_line:0:44}"
+  unset _gf_line
+fi
 # CLAUDE.global.md line-count guard (anti-regression). BDR-062 supersedes
 # BDR-031's 275 target: 305 is the assumed reality (extraction done at
 # job1; further compression costs clarity > token gain) — warn past 320.