chore(githooks): refresh pre-commit (gitleaks protect fallback) + track reference-transaction

.githooks/reference-transaction

@@ -0,0 +1,15 @@
+#!/bin/sh
+# gitflow reference-transaction — generated by gitflow_init. Do not hand-edit.
+# Refuses deleting (or renaming) main / develop, whatever the
+# command. Mirrors gitflow_protected_base (lib/gitflow.sh).
+[ "$1" = prepared ] || exit 0
+while read -r _old new ref; do
+  case "$ref" in refs/heads/main|refs/heads/develop) ;; *) continue ;; esac
+  case "$new" in *[!0]*) continue ;; esac     # new value not all-zeros → an update, not a deletion
+  # Per-repo opt-out (a foreign clone): git config gitflow.protect false
+  [ "$(git config --bool --default true gitflow.protect)" = false ] && exit 0
+  echo "gitflow reference-transaction: BLOCKED — deleting '$ref', a protected base." >&2
+  echo "  main and develop are never deleted or renamed. A merged working branch: gitflow.sh delete <branch>" >&2
+  exit 1
+done
+exit 0