feat: PreToolUse workflow guard hook for rogue edit prevention (#678) (#1197)

New opt-in PreToolUse hook that warns when Claude edits files outside
a GSD workflow context (no active /gsd: command or subagent).

Soft guard — advises, does not block. The edit proceeds but Claude
sees a reminder to use /gsd:fast or /gsd:quick for state tracking.

Enable: set hooks.workflow_guard: true in .planning/config.json
Default: disabled (false)

Allows without warning:
- .planning/ files (GSD state management)
- Config files (.gitignore, .env, CLAUDE.md, settings.json)
- Subagent contexts (executor, planner, etc.)

Includes 3s stdin timeout guard and silent fail-safe.

Closes #678

get-shit-done/workflows/settings.md

@@ -160,7 +160,8 @@ Merge new settings into existing config.json:
     "branching_strategy": "none" | "phase" | "milestone"
   },
   "hooks": {
-    "context_warnings": true/false
+    "context_warnings": true/false,
+    "workflow_guard": true/false
   }
 }
 ```