fix(hook-kit): relocate domain-owned ask guards and retire the unregistered duplicates

[daegunjhy]

Hook placement cleanup, in two independent commits.

Why this came up

hook-kit's own frontmatter describes it as a hook management toolkit — audit / edit / install / move / remove. It is not a repository for every hook. But guards had been accumulating there justified by precedent ("similar guards already live in hook-kit") rather than by ownership, and two separate problems had grown out of that.

1. Relocate domain-owned guards (3b772cc6)

Two guards whose logic belongs to a single other skill's domain:

Guard	To	Why
block-squash-recommend-multi-commit.sh	github-flow/resources/	Gates a PR merge-method recommendation. github-flow already owns the PR-domain ask guard block-pr-url-gate.sh, and merge.md defines the commit-count/distinctness rule this enforces
block-new-skill-ready-without-ask.sh	skill-kit/resources/	Gates readying a PR that introduces a new skill directory — skill publication scope is skill-kit's domain

Neither script carries relative references, so this is a pure relocation (R100) plus two hooks.json path updates.

2. Retire the unregistered ask-guard duplicates (02e6bb20)

hook-kit carried its own ask-guard.sh and block-axis-merged-ask.sh while the ask-user plugin carried the same two under the same names. Only the ask-user copies were ever registered — so every commit landing on these files ran nowhere, and the two lines kept diverging anyway.

By the time this surfaced, the unregistered copies were the newer of the two (2026-08-21 vs 08-20), and each side held fixes the other lacked:

• hook-kit only — :-→:+ pattern-variable convention (the git-ignored locale file was replacing committed patterns wholesale), retrospect append-guarantee, solo-infra-repo exemption, CI-gate-only exemption as a runtime gh pr checks probe, resolve_guards_config()
• ask-user only — ugrep stderr silencing, push-detail FP hardening (word-boundary anchoring, meta vs negation scope separation, per-option verdict), HG_ASK_CI_GATE_ONLY_ATTESTATION

Both lines were merged into the registered copies first (daegunsoftDev/skills PR #24), so this removal drops no behaviour. The three standalone test scripts move with them; no CI target referenced those, so nothing here loses coverage.

Registry entries become tombstones rather than deletions — hook-registry.yaml treats deletion records as data that survives regeneration, and a duplicate that silently never fired is exactly the history worth keeping.

Test plan

• bats tests/ → 24/24 pass, including test 24 (every hooks.json command path resolves on disk) after both relocations
• Both relocated guards' own --test self-tests → PASS at their new paths
• hook_registry_verify.py --check → 8 findings, unchanged from the pre-change baseline (the 2 SCHEMA findings the tombstones introduced are resolved; the remaining 8 are pre-existing and unrelated)
• hook-registry.yaml parses as valid YAML (81 hooks)
• Pre-push CI parity (lint-frontmatter + bats + pytest) passed on push

Related

daegunsoftDev/skills PR #24 is the other half of the divergence — it holds the merged guards this PR retires, plus a new guard for the failure that exposed all of this.