docs: inspect attach-guard CLI and tests

[hammadtq]

Summary

• Documents current attach-guard CLI commands, hook/plugin flow, package-manager parser coverage, and test layout
• Records build/test commands and the current Hermes runtime blocker: Go is not installed here
• Identifies Attach Open Score integration seams, including the verdict/UNKNOWN mapping and critical score-polarity mismatch
• Lists stale Socket-default docs/config assumptions to unwind before default Open Score integration

Verification

• git diff --cached --check before commit
• Added-docs secret pattern scan: clean
• make test attempted: blocked, go missing in runtime
• make vet attempted: blocked, go missing in runtime
• make build attempted: blocked, go missing in runtime
• Independent reviewer pass; blocker fixed by adding explicit Open Score risk-score polarity warning

Source/legal posture

• Docs-only inspection; no code changes
• No secrets/private platform data
• No proprietary vendor scores copied or generated
• Socket treated as existing BYO/local provider; report flags stale Socket-default assumptions to unwind

Kanban: t_6f85b57c

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews