chore(release): @hasna/hooks 0.5.0

[andrei-hasna]

Release cut for the destructive-command guard merged in #10 (merge commit 7e94256).

What ships

The pre-bash hook now refuses recursive deletes that resolve to a protected root, including the shape that caused the 2026-07-24 incident: rm -rf "$(bun pm cache)"/* where the substitution collapses to empty and the command becomes rm -rf /*.

Analysis bounds fail closed: any bound that stops modelling a command marks the analysis degraded, and a degraded analysis carrying a recursive delete is refused.

Verification on the merge commit (7e94256), run unpiped

• bun test > file 2>&1; echo $? -> exit 0; 1038 pass / 0 fail, 3880 expect() calls, 17 files.
• Classifier driven with command strings (nothing executed): 14/14 must-block refused, including the incident command; 6/6 ordinary commands allowed.
• Same corpus against pre-merge main (d8c0e8a): only 5/14 refused — main allowed the incident command and rm -rf /*.

Known residual (unchanged from main, not a regression)

Pipe and value indirection is not covered: echo /etc | xargs rm -rf, rm -rf $(echo /etc), T=/; rm -rf $T. Measured identical on main and on this release, so shipping is strictly better than the status quo, not worse.

Known false-positive class

Deletes anywhere under ~/.hasna are refused, which includes routine task-worktree cleanup at ~/.hasna/repos/worktrees/<repo>/<task>. Fails safe, but it will block worktree cleanup automation.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}