Add ctxguard: hook-enforced context sanitization

Keeps credentials, company names, personal names and PII out of the model's
context. Enforcement lives in Claude Code hooks rather than in instructions to
the agent: a skill alone cannot protect anything, because by the time the agent
reads a rule the surrounding context has already been sent.

Credentials are removed irreversibly and marked. Entities from a user-supplied
dictionary become stable aliases, rewritten back to real values on their way to
disk and to the shell, so code and commands referring to them still work.

Published from a clean tree; development history is not included.

plugins/ctxguard/scripts/ctxguard.py

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+"""ctxguard entry point. Kept dependency-free and importable from any cwd."""
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from ctxguard.cli import main  # noqa: E402
+
+if __name__ == "__main__":
+    sys.exit(main())