Block pushes and commits to main with git hooks

pre-push rejects any push that would update refs/heads/main, however the
command is spelled; pre-commit and pre-merge-commit refuse commits while
main is checked out. npm install enables them via core.hooksPath. The
README documents the three layers of protection for main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

package.json

@@ -6,7 +6,8 @@
   "bin": { "todo": "./src/cli.js" },
   "scripts": {
     "start": "node src/cli.js",
-    "test": "node --test"
+    "test": "node --test",
+    "prepare": "git config core.hooksPath .githooks"
   },
   "engines": { "node": ">=20" },
   "license": "MIT"