hook: pretool-gate.sh

Part 3 · EACH TOOL · Slide 48 of 60

Event: PreToolUse on Bash · 300 s.
Rule 1, the ship gate: no `git push` while doctor or eval is
red. Rule 2, the shadow guard: no consumer plugin install on a
machine running the plugin from its source tree. Fast path is
one builtin read and one case statement; everything else
happens only when a rule's token is present.