feat(git-harden): implement git-harden.sh script

Interactive shell script that audits and hardens global git config.
Implements the design spec with: object integrity checks, protocol
restrictions, filesystem protection, hook redirection, SSH signing
wizard with FIDO2 support, SSH config hardening, and credential
helper detection. Supports --audit, -y, and interactive modes.

Implements: #5

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,32 @@
+# === Crosslink managed (do not edit between markers) ===
+# .crosslink/ — machine-local state (never commit)
+.crosslink/issues.db
+.crosslink/issues.db-wal
+.crosslink/issues.db-shm
+.crosslink/agent.json
+.crosslink/session.json
+.crosslink/daemon.pid
+.crosslink/daemon.log
+.crosslink/last_test_run
+.crosslink/keys/
+.crosslink/.hub-cache/
+.crosslink/.knowledge-cache/
+.crosslink/.cache/
+.crosslink/hook-config.local.json
+.crosslink/integrations/
+.crosslink/rules.local/
+
+# .crosslink/ — DO track these (project-level policy):
+#   .crosslink/hook-config.json   — shared team configuration
+#   .crosslink/rules/             — project coding standards
+#   .crosslink/.gitignore         — inner gitignore for agent files
+
+# .claude/ — auto-generated by crosslink init (not project source)
+.claude/hooks/
+.claude/commands/
+.claude/mcp/
+
+# .claude/ — DO track these (if manually configured):
+#   .claude/settings.json         — Claude Code project settings
+#   .claude/settings.local.json is per-developer, ignore separately if needed
+# === End crosslink managed ===