feat: prompt-leak resilience + runtime boundaries (F34) + enchanter-hooks v0.7

[klaiderman]

Summary

Hardens VIS against untrusted-context / prompt-leak failures and ships the runtime-enforcement layer for them — combining the F34 / agent-runtime-boundaries conduct work with the v0.7 wave of enchanter-hooks.

Conduct & taxonomy

• F34 — Untrusted-context injection (indirect prompt injection): host-agnostic taxonomy doc + runbook, registered in failure-modes.md and the taxonomy index.
• agent-runtime-boundaries.md recipe — host trust boundaries, anti-laundering, provenance preservation across hand-offs.
• docs/evals/agent-boundary-checklist.md — 6 adversarial pass/fail cases.
• web/conduct/ resilience set + core context-budget / memory-discipline modules.

enchanter-hooks v0.7 (11 → 15) — the runtime half

All advisory, fail-open (exit 0), quiet, tied to deterministic Claude Code hook events:

Hook	Event	Role
context-taint-scan	PostToolUse(Read|Grep|WebFetch)	directive language in retrieved tool_response — F34 runtime counter
delegation-scope-guard	SubagentStart	scope+provenance reminder injected into a risky subagent's own context (anti-laundering)
evidence-gate	Stop	flags unbacked completion/verification claims (no loop; stderr+exit 0)
dependency-intent-receipt	PreToolUse(Bash + Write|Edit)	supply-chain provenance on dep changes
compact-checkpoint (extended)	SessionStart(compact)	obligation anchor: approvals / denied approaches / security boundaries / verification debt

New packages/hooks/tests/verify-hooks.sh self-test.

Verification

• tests/verify-hooks.sh: 74 passed, 0 failed — fail-open + quiet on empty/malformed payloads, one useful advisory per high-signal trigger, valid JSON configs, LF-only, no network-tool invocation, every registered script exists.
• bash -n on all 16 scripts; jq -e on all 3 JSON configs.

Limitations

• No live Claude Code runtime test — payloads simulated from the documented hook schemas.
• SubagentStart uses a broad .* matcher gated in-script by risk markers.
• evidence-gate is advisory-to-human (no receipt ledger to verify against yet).