ci: mirror hashview lint & security gates

[bandrel]

Summary

Mirrors the lint and security gates the hashview repo runs, adapted to hate_crack's uv toolchain. Requested to add format checking to CI, then extended to the rest of hashview's gates where they fit.

New CI (ci.yml) — three jobs:

• checks — adds ruff format --check alongside the existing ruff lint, ty, and pytest.
• bandit — SAST against a committed baseline (.bandit-baseline.json); only new findings fail. hate_crack shells out to hashcat heavily, so the baseline captures 114 reviewed low-severity subprocess/shlex findings. Config in [tool.bandit].
• pip-audit — dependency-CVE gate over the synced env. PYSEC-2026-2447 (diskcache 5.6.3, transitive via instructor → atomic-agents) is ignored — no fixed release exists upstream yet.

Local hooks (prek.toml):

• ruff-format and bandit added at pre-push (mirror the CI gates).
• Hygiene hooks from pre-commit/pre-commit-hooks at pre-commit stage: trailing-whitespace, end-of-file-fixer, check-yaml, check-merge-conflict, check-added-large-files.

Also:

• The package was reformatted (ruff format) in a separate style: commit so the CI format check passes — this is the bulk of the diff and is whitespace-only.
• CLAUDE.md updated: lint/security commands, prek install now includes --hook-type pre-commit, and the active-hooks list.

Not mirrored (don't fit): openapi-spec-validator (no API spec), pylint (ruff + ty already cover lint), mutation testing / multi-python matrix (overkill here).

Test Plan

All gates verified locally before push:

• ruff check — clean
• ruff format --check — 17 files already formatted
• ty check — exit 0
• bandit -b .bandit-baseline.json — exit 0 (no new findings)
• pip-audit --ignore-vuln PYSEC-2026-2447 — no known vulnerabilities
• pytest — 1044 passed (1 pre-existing test: hate_path global leak in test_markov_e2e.py can flake test_main_pcfg #118 ordering flake, passes in isolation)
• all three workflow YAMLs parse

Note: prek isn't installed locally, so the remote hygiene-hook block couldn't be runtime-validated. The two new local hooks (ruff-format, bandit) were verified by running their entries directly. Recommend a prek run --all-files after checkout to confirm the remote block resolves.

🤖 Generated with Claude Code