Add ctxguard: hook-enforced context sanitization

Keeps credentials, company names, personal names and PII out of the model's
context. Enforcement lives in Claude Code hooks rather than in instructions to
the agent: a skill alone cannot protect anything, because by the time the agent
reads a rule the surrounding context has already been sent.

Credentials are removed irreversibly and marked. Entities from a user-supplied
dictionary become stable aliases, rewritten back to real values on their way to
disk and to the shell, so code and commands referring to them still work.

Published from a clean tree; development history is not included.

plugins/ctxguard/commands/ctx-verify.md

@@ -0,0 +1,25 @@
+---
+description: Prove ctxguard actually blocks what it claims, and measure real leakage
+---
+
+Two different questions, two different commands. Run both.
+
+1. Does the machinery work? Drives the canary corpus through the real hook entry
+   points in an isolated state directory:
+
+```
+python3 "${CLAUDE_PLUGIN_ROOT}/scripts/ctxguard.py" verify
+```
+
+2. Did anything actually leak? Scans the transcripts — the record of what was really
+   sent to the model — for real values from the dictionary:
+
+```
+python3 "${CLAUDE_PLUGIN_ROOT}/scripts/ctxguard.py" scan-transcript
+```
+
+Report both numbers plainly. The second is the one that matters: the first measures
+intent, the second measures outcome. If `scan-transcript` is non-zero, say so
+directly — it means data reached the model despite the hooks.
+
+For a red-team run, `verify --adversarial` prints a brief to hand to a subagent.