hlint loads the repo's hint configuration

## Summary

`hlint.yaml` is never read. HLint auto-discovers only the dotted name
`.hlint.yaml`, and nothing in the repo passes `-h`, so every setting in the
file — the enabled groups and the `unsafePerformIO` restriction — is inert
in both pre-commit and CI.

## Motivation

Found while porting the hint-group survey to alunduil/network-arbitrary#116.
Verifying that hlint picks up a root config turned up the filename rule, and
the same probe run against this repo reproduces it.

`.pre-commit-config.yaml` invokes the hook as bare `hlint`:

```yaml
- id: hlint
name: hlint
entry: hlint
language: system
types: [haskell]
```

A probe module dropped into the repo root at `536bdac`, with hlint 3.10 (the
version `.github/workflows/pre-commit.yml` pins):

```console
$ hlint ProbeTmp.hs
ProbeTmp.hs:6:1-39: Warning: Missing NOINLINE pragma
1 hint

$ hlint -h hlint.yaml ProbeTmp.hs
ProbeTmp.hs:6:9-23: Warning: Avoid restricted function
Found:
unsafePerformIO
Note: may break the code

ProbeTmp.hs:6:32-35: Warning: Avoid partial function
Found:
succ
3 hints
```

The `unsafePerformIO` ban and the `partial-strict` hint fire only with `-h`.
`src/` and `test/` score zero hits either way today, so nothing is currently
mislinted — the gap shows up the first time a contributor writes a
restricted or partial call and the hook waves it through.

This also means the decisions recorded in #105, #132, and #166 have never
been enforced, and the surveys proposed in #170, #171, #172, #173, and #174
would land in a file nothing reads.

## Scope

- Rename `hlint.yaml` to `.hlint.yaml` so hlint discovers it without a flag.
- Update the `hlint.yaml` reference in `CLAUDE.md`'s Lint / format entry.

Passing `-h hlint.yaml` from the hook entry is the alternative. The rename
is preferable: one less flag to keep in sync between the hook and any direct
`hlint` invocation a contributor or editor integration makes.

## Acceptance criteria

- [ ] Bare `hlint` from the repo root loads the config — a probe using
`unsafePerformIO` or `succ` reports the restricted/partial warnings
without `-h`.
- [ ] pre-commit and the Pre-commit workflow stay green.
- [ ] No stale `hlint.yaml` path remains in `CLAUDE.md` or elsewhere.

## Additional context

`hlint --help` lists the flag as `-h --hint=FILE Hint/ignore file to use`.
Auto-discovery of the dotted name is separate and needs no flag.