fix(scan): exclude inactive Git hook samples

[kriptoburak]

Summary

• classify inactive .git/hooks/*.sample templates as VCS metadata
• keep .git/config and active hook files in the bounded scan scope
• cover the boundary with an executable sample-hook regression

Problem

A fresh git init creates executable sample hooks. SkillSpector inventoried all 14 templates as hidden artifacts, emitted an SC9 HIGH finding for each, and rated an otherwise safe one-file skill as risk 56 with DO_NOT_INSTALL.

The templates are not active while they retain the .sample suffix. They also come from the local Git installation rather than the scanned repository. Active hooks such as .git/hooks/pre-commit still enter the scan.

Validation

• failing-first regression: 1 expected failure
• focused regression: 1 passed
• complete unit selection in bounded groups: 2,796 passed, 13 skipped, 4 xfailed
• make lint
• make format-check
• git diff --check

The minimal safe Git skill now reports 0 findings and SAFE. A remote scan of Xquik-dev/x-twitter-scraper removes the 14 clone-generated sample-hook findings while retaining 100% component coverage and all repository-owned findings.

Fixes #411