Install hooks by copying into .git/hooks instead of core.hooksPath

Linking core.hooksPath to the tracked, sandbox-writable .githooks/ let a
sandboxed command rewrite a hook that git commit/push then run unsandboxed.
Copies in .git/hooks can't be changed from the sandbox. This also keeps
existing .git/hooks scripts working and lets npm install succeed outside a
git checkout. pre-merge-commit now names itself in errors; hook tests clean
up, ignore GIT_* env and cover the installer; docs state what each layer
does and doesn't stop.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

package.json

@@ -7,7 +7,7 @@
   "scripts": {
     "start": "node src/cli.js",
     "test": "node --test",
-    "prepare": "git config core.hooksPath .githooks"
+    "prepare": "sh scripts/install-hooks.sh"
   },
   "engines": { "node": ">=20" },
   "license": "MIT"