23f21820 -- package-install verification gate.

Accepts a Bash command string (from the PreToolUse hook), extracts any pip/npm/uvx install operations, and checks each package against its registry (PyPI JSON API or npm registry). Returns a gate decision:

• action: "allow" | "warn"
• message: advisory text (empty when allow)
• packages: list of extracted package names
• results: per-package registry check details
• allowlisted_all: true when every package was in the known-good allowlist

Fails open: any server-side error returns action="allow" so a Meridian availability issue never permanently wedges an executor session.