Same fix as doc-guardian - prompt hooks unreliable.
Command hook guarantees exact behavior.
- Add security-check.sh that skips config/doc files silently
- Only checks code files for hardcoded secrets
- Outputs with [code-sentinel] prefix
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
