release: prepare gooblin 1.3.2 installer safety patch

[jsleemaster]

What

• bumps package, plugin, and hook metadata to 1.3.2
• adds the v1.3.2 release gates and exact source evidence
• documents the npm 1.3.1 safety boundary with a required resolved-version check
• adds Node 24 git diff --check and npm pack --dry-run CI gates

Why

PR #58 made the GitHub-source installer non-destructive, but npm 1.3.1 still contains recursive replacement/removal. This release candidate prepares the immutable patch version needed to finish #57 without claiming it is already published.

Gates

• Node 18/20/24 npm run validate
• Node 24 git diff --check
• Node 24 npm pack --dry-run
• version surfaces agree on 1.3.2
• independent review of exact final HEAD: CLEAN
• merge to main and green main CI
• current Claude Code and Codex CLI install-path verification from main
• npm publish and live registry/npx destructive-refusal verification
• immutable tag, GitHub release, and observed-result docs

CI evidence: Validate run 29234721595 for exact head 4fabc738fdeda7cc700614c57290908bd1449080. All Node lanes passed; Node 24 passed the whitespace and pack gates. The final pack output was gooblin-1.3.2.tgz, 324.5 kB packed / 437.8 kB unpacked, 88 files, shasum c358ef8bd5bcd6d0651f4c0b333a0d3a76e428b9.

Known payload limitation: examples referenced by the README are not installed by the current copy-only installer; ownership-aware payload completion remains in #49 and is not claimed by this safety release.

Part of #57.