ci: deny unwrap_used/expect_used on the library target

Add [lints.clippy] unwrap_used = "deny", expect_used = "deny" plus a tracked
pre-commit hook running `cargo clippy --lib -- -D warnings`. Library code may
not hide a panic behind unwrap/expect; panic!/unreachable! stay un-linted as
the explicit sanctioned form. Gate is the library target only — tests and
examples are not gated. A fresh clone must run
`git config core.hooksPath .githooks` to enable the hook.

.githooks/pre-commit

@@ -0,0 +1,8 @@
+#!/bin/sh
+# smarm pre-commit gate: clippy the library (src/) with warnings as errors.
+# unwrap_used / expect_used are denied (Cargo.toml [lints.clippy]): library
+# code must not hide a panic behind unwrap/expect. Tests/examples are not gated.
+set -eu
+[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"
+cd "$(git rev-parse --show-toplevel)"
+cargo clippy --lib -- -D warnings