chore: add guardrail hooks against eslint-disable bypass

- .husky/pre-commit: fail the commit if staged diff adds an
  eslint-disable comment on ts/tsx/js/mjs files
- .claude/hooks/warn-eslint-disable.sh + settings.json PostToolUse
  hook: warn (non-blocking) after Write/Edit if the touched file
  contains eslint-disable, so agents get feedback immediately
  instead of only at commit time

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.claude/hooks/warn-eslint-disable.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# PostToolUse hook (Write|Edit): warns if the touched file contains an eslint-disable comment.
+# Does not block the edit — see feedback memory "no lint-disable bypass".
+set -euo pipefail
+
+f=$(jq -r '.tool_input.file_path // .tool_response.filePath // empty')
+
+case "$f" in
+*.ts | *.tsx | *.js | *.mjs) ;;
+*) exit 0 ;;
+esac
+
+if [ -f "$f" ] && grep -q 'eslint-disable' "$f" 2>/dev/null; then
+	jq -n --arg f "$f" \
+		'{systemMessage: ("eslint-disable found in " + $f + " — fix the underlying lint issue instead of disabling the rule. If a disable is truly warranted, name the specific rule, add a one-line justification, and flag it to the user.")}'
+fi

.claude/settings.json

@@ -0,0 +1,16 @@
+{
+	"hooks": {
+		"PostToolUse": [
+			{
+				"matcher": "Write|Edit",
+				"hooks": [
+					{
+						"type": "command",
+						"command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/warn-eslint-disable.sh\"",
+						"timeout": 10
+					}
+				]
+			}
+		]
+	}
+}

.husky/pre-commit

@@ -1 +1,15 @@
+disabled=$(git diff --cached -U0 -- '*.ts' '*.tsx' '*.js' '*.mjs' \
+	| grep -E '^\+' \
+	| grep -Ev '^\+\+\+' \
+	| grep -E 'eslint-disable' || true)
+
+if [ -n "$disabled" ]; then
+	echo "error: commit adds eslint-disable comment(s):"
+	echo "$disabled"
+	echo
+	echo "Fix the underlying lint issue instead of disabling the rule."
+	echo "If a disable is genuinely warranted, name the specific rule, add a one-line justification, and flag it in the PR description."
+	exit 1
+fi
+
 npm run lint && npm run build