Drive all 4 remaining tasks to completion through full lifecycle

- actionable-phase-guidance: lifecycle artifacts + .state->complete
- harden-enforcement-layers: pre-push hook, install-hooks.sh, register-guards.sh, prompt pre-edit checks, harness contract update, install/update/upgrade script integration
- plug-stale-task-hole: lifecycle artifacts + .state->complete
- port-pi-guard: pi dev guard plugin, package.json, register-guards integration

All tasks passed bug_find, adversarial_bug_find, doc_review, and referee phases with PASS verdict.

scripts/install-hooks.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# install-hooks.sh — Install automaton git hooks into the current project.
+#
+# Usage: bash ~/.automaton/scripts/install-hooks.sh [project-path]
+#
+# Installs pre-commit and pre-push hooks. The pre-commit hook blocks
+# commits when no task is in implement/doc_review. The pre-push hook
+# blocks pushes in the same condition, catching --no-verify bypasses.
+
+set -euo pipefail
+
+PROJECT_DIR="${1:-$(pwd)}"
+GIT_DIR="$PROJECT_DIR/.git"
+HOOKS_DIR="$GIT_DIR/hooks"
+FRAMEWORK_DIR="$HOME/.automaton"
+
+if [ ! -d "$GIT_DIR" ]; then
+    echo "ERROR: $PROJECT_DIR is not a git repository (no .git directory)"
+    exit 1
+fi
+
+mkdir -p "$HOOKS_DIR"
+
+HOOKS=(
+    "pre-commit"
+    "pre-push"
+)
+
+installed=0
+for hook in "${HOOKS[@]}"; do
+    SOURCE="$FRAMEWORK_DIR/scripts/git-hooks/$hook"
+    TARGET="$HOOKS_DIR/$hook"
+    if [ ! -f "$SOURCE" ]; then
+        echo "WARNING: Source hook not found: $SOURCE"
+        continue
+    fi
+    cp "$SOURCE" "$TARGET"
+    chmod +x "$TARGET"
+    echo "Installed: $TARGET"
+    installed=$((installed + 1))
+done
+
+echo ""
+echo "$installed hook(s) installed in $PROJECT_DIR"
+echo ""
+echo "Pre-commit:  Blocks commits without an active task in implement/doc_review"
+echo "Pre-push:    Blocks pushes without an active task (catches --no-verify bypasses)"
+echo ""
+echo "To reinstall after automaton update, re-run this script."