ci: mirror hashview lint/security gates

Adds the gates the hashview repo runs, adapted to hate_crack's uv toolchain:

- ruff format --check as a CI step + a ruff-format prek pre-push hook
  (the package was reformatted in the preceding commit).
- Bandit SAST vs a committed baseline (.bandit-baseline.json, 114 reviewed
  low-severity subprocess/shlex findings); [tool.bandit] config in
  pyproject.toml; CI job + prek pre-push hook. Only NEW findings fail.
- pip-audit dependency-CVE gate (CI job). PYSEC-2026-2447 (diskcache 5.6.3,
  transitive via instructor -> atomic-agents) is ignored — no upstream fix.
- Hygiene pre-commit hooks (trailing-whitespace, end-of-file-fixer, check-yaml,
  check-merge-conflict, check-added-large-files) via the pre-commit-hooks repo.
- CLAUDE.md updated: lint/security commands, prek install (+pre-commit hook
  type), and the active-hooks list.

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -33,9 +33,12 @@ jobs:
       - name: Install dependencies
         run: uv sync --dev
 
-      - name: Ruff
+      - name: Ruff (lint)
         run: uv run ruff check hate_crack
 
+      - name: Ruff (format)
+        run: uv run ruff format --check hate_crack
+
       - name: Ty
         run: uv run ty check hate_crack
 
@@ -43,3 +46,48 @@ jobs:
         env:
           HATE_CRACK_SKIP_INIT: "1"
         run: uv run pytest -q
+
+  # Bandit SAST against the committed baseline (.bandit-baseline.json): only
+  # findings NOT already in the baseline fail the build. hate_crack shells out
+  # to hashcat extensively, so the baseline captures the reviewed low-severity
+  # subprocess/shlex findings. Config lives in [tool.bandit] in pyproject.toml.
+  bandit:
+    name: Bandit SAST
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
+
+      - name: Bandit (vs baseline)
+        run: >-
+          uvx --from "bandit[toml]==1.9.4" bandit
+          -r hate_crack -c pyproject.toml -b .bandit-baseline.json
+
+  # pip-audit: fail on dependencies with known CVEs (PyPI / OSV advisory DB).
+  # Audits the synced project environment. PYSEC-2026-2447 (diskcache 5.6.3, a
+  # transitive dep via instructor -> atomic-agents) is ignored because no fixed
+  # release exists upstream; revisit when diskcache ships a fix.
+  pip-audit:
+    name: pip-audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
+        with:
+          python-version: "3.13"
+          enable-cache: true
+          cache-dependency-glob: "**/uv.lock"
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Audit dependencies
+        run: >-
+          uv run --with pip-audit==2.10.0 pip-audit
+          --progress-spinner off --ignore-vuln PYSEC-2026-2447