Deterministic governance plugin for Claude Code with fail-closed hooks, forensic history, and post-session verification.