feat: CUDA kernel guard + ruflo hooks for subagent monitoring

Add scripts/cuda-kernel-guard.sh — catches CPU/host leaks in .cu files:
printf, cudaMalloc/Free, host API calls, double-precision math (exp/log
instead of expf/logf), assert, file I/O. Filters comments and trailing
/* */ annotations. Zero false positives across 38 production kernels.

Extend gpu-hotpath-hook.sh to route .cu/.cuh files to the new guard.

Configure ruflo hooks in .claude/settings.json: pre-edit context loading,
post-edit pattern learning, post-command metrics, session-end persistence.
Fires for subagents too via Claude Code hook system.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/gpu-hotpath-hook.sh

@@ -11,23 +11,35 @@ if [ -z "$FILE" ] || [ ! -f "$FILE" ]; then
     exit 0
 fi
 
-# Only check Rust files
+# Check Rust and CUDA files
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
 case "$FILE" in
-    *.rs) ;;
+    *.rs)
+        GUARD="$SCRIPT_DIR/gpu-hotpath-guard.sh"
+        if [ -x "$GUARD" ]; then
+            OUTPUT=$("$GUARD" "$FILE" 2>&1) || {
+                echo "⛔ GPU HOT-PATH HARD ERROR in $FILE"
+                echo "$OUTPUT"
+                echo ""
+                echo "CPU usage in GPU hot paths is NOT allowed. Fix the code — do not annotate with // gpu-ok:"
+                exit 1
+            }
+        fi
+        ;;
+    *.cu|*.cuh)
+        GUARD="$SCRIPT_DIR/cuda-kernel-guard.sh"
+        if [ -x "$GUARD" ]; then
+            OUTPUT=$("$GUARD" "$FILE" 2>&1) || {
+                echo "⛔ CUDA KERNEL HARD ERROR in $FILE"
+                echo "$OUTPUT"
+                echo ""
+                echo "CPU/host operations in CUDA kernels are NOT allowed."
+                exit 1
+            }
+        fi
+        ;;
     *) exit 0 ;;
 esac
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-GUARD="$SCRIPT_DIR/gpu-hotpath-guard.sh"
-
-if [ -x "$GUARD" ]; then
-    OUTPUT=$("$GUARD" "$FILE" 2>&1) || {
-        echo "⛔ GPU HOT-PATH HARD ERROR in $FILE"
-        echo "$OUTPUT"
-        echo ""
-        echo "CPU usage in GPU hot paths is NOT allowed. Fix the code — do not annotate with // gpu-ok:"
-        exit 1
-    }
-fi
-
 exit 0