ci: add a Uniswap v4 hook risk check

[chaosxcode]

Adds one workflow that runs HookGuard on every pull request.

What it does. It looks for a specific set of Uniswap v4 mistakes and comments on the exact line when it finds one — callbacks any address can call, hooks keeping per-pool state without checking which pool is calling, dynamic fees with no ceiling. Every rule traces to published guidance (Trail of Bits' v4 hooks paper, Uniswap's security framework) or to the Bunni v2 and Cork post-mortems.

On this repo specifically. It picks up LaunchHook in this repo and currently flags nothing. I'd rather show you that than invent a problem — the value is that it stays quiet unless something changes.

It can't block you. fail-on: never means annotations only. Drop that line if you'd rather it gate on serious findings.

Straight about the limits. Heuristic pattern matching, not an audit. It reads permissions and source patterns, not what your hook actually does. A flag means worth a look, never broken; silence means nothing matched at this level, never safe.

I tested it against 272 real deployed hooks and wrote up the five ways it was wrong, plus what I changed. Just over half of real hooks come back clean.

Close it without a second thought if you'd rather not take on a dependency.