Docker DB Guardrails

Sets up a PreToolUse hook that blocks schema/data-wipe commands run against a Docker container's real database, unless that database's actual resolved name visibly indicates it is disposable.

The incident this guards against

An agent needed to run a Laravel feature test against code on a branch that hadn't been deployed yet. The target container (a real staging deployment) had PHP and Composer installed, so the agent:

1. Copied the container's /var/www/html to a temp path (/tmp/test-branch).
2. Overlaid the branch's changed files on top of that copy.
3. Ran php artisan migrate:fresh --env=testing --force from that temp path, believing the copy gave it isolation.