Add attester package-verification instruction and import-check hook

The instruction tells Copilot to verify PyPI/npm package and symbol names
against the attester.dev existence oracle (free keyless tier, 25 calls/day
per client IP) before installing or importing, catching hallucinated
dependency names (5.2-21.7% of LLM suggestions per USENIX Security 2025).
The preToolUse hook enforces the same check on code the agent writes:
stdlib-only script, blocks only on a confident oracle negative, fails open
on quota or network trouble, caches answers on disk. README tables
regenerated with npm start.

hooks/attester-import-check/hooks.json

@@ -0,0 +1,16 @@
+{
+  "version": 1,
+  "hooks": {
+    "preToolUse": [
+      {
+        "type": "command",
+        "bash": "hooks/attester-import-check/check-imports.py",
+        "cwd": ".",
+        "env": {
+          "ATTESTER_MODE": "block"
+        },
+        "timeoutSec": 30
+      }
+    ]
+  }
+}