adopt the defect-class guard method: generalize kamerplanter's workflow-gate-integrity hook

Depends on nolte/claude-shared#573, which defines the method these hooks implement.

Why here

nolte/kamerplanter runs 20 pre-commit hooks that each lock in one closed defect class, named after its issue. This repository ships two generic hooks. Most of kamerplanter's are domain-bound (tenant keys, seed schemas, plant phases) and stay there. A few are not.

Candidate, and it is a candidate, not a given

workflow-gate-integrity (kamerplanter#1313): no CI gate that cannot fail, or cannot run on the change it is meant to check.

It is the strongest candidate because it mechanises the failure class on the CI side, and every repository with GitHub Actions has that surface. The defects it was built from, all real and all invisible while green:

• kamerplanter#1235 — a freshness check whose grace window is anchored on the newest build rather than on the pin, so it can never alert
• kamerplanter#1302 — a pin assertion whose path filter excludes the very file whose pin it asserts, so it cannot fire on the PR that changes it
• kamerplanter#1228 — a pre-publish gate requiring a check that structurally cannot report at the point it is demanded
• kamerplanter#1308 — a clean scan and a scan that never ran, indistinguishable downstream

Adoption is conditional: the hook must be configurable without kamerplanter's path assumptions. If it cannot be, say so and close — a hook that only works in one repository belongs in that repository.

A second, weaker candidate is a generic form of layer-imports. Assess it after the first lands, or not at all.

Acceptance criteria

• The hook runs against a repository other than kamerplanter with no kamerplanter-specific configuration
• Falsification, per adopted hook: restore the pre-fix state of kamerplanter#1235 and of #1302 and run the hook. Red both times. A hook that is green in its origin repository and has never been red in the new one is not verified, it is installed.
• spec/hook-authoring references nolte/claude-shared#573 as the method the hook implements

References

• kamerplanter spec/analysis/development-process-improvement-plan-2026-09-11.md §M3
• kamerplanter#1313, #1235, #1302, #1228, #1308

Start by reading the method definition in nolte/claude-shared#573, the workflow-gate-integrity candidate from kamerplanter#1313, and spec/hook-authoring. Assess whether the hook works in a repository other than kamerplanter without repository-specific configuration; if adopted, verify it goes red for the restored #1235 and #1302 defects and references #573 in spec/hook-authoring.