migrate to the new tiered structure

example/.safeclaude/hooks/20-bundle.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Installs gems, but only when Gemfile.lock has changed: it remembers the last
+# version it installed (saved between runs), so an unchanged lockfile is a
+# near-instant no-op.
+set -euo pipefail
+
+[ -f /code/Gemfile ] || exit 0
+eval "$(rbenv init - bash)"
+
+LOCK=/code/Gemfile.lock
+MARKER="$HOME/.safeclaude-deps/gemfile.sha"
+mkdir -p "$(dirname "$MARKER")"
+CUR="$( [ -f "$LOCK" ] && sha256sum "$LOCK" | cut -d' ' -f1 || echo no-lock )"
+
+if [ "$(cat "$MARKER" 2>/dev/null || true)" != "$CUR" ]; then
+  echo "[bundle] installing gems..."
+  # The token below (for a private gem source) comes from .safeclaude/.env — see
+  # .env.example. It's fine to leave unset if your project doesn't need it.
+  ( cd /code && BUNDLE_GEMS__GRAPHQL__PRO="${BUNDLE_GEMS__GRAPHQL__PRO:-}" bundle install )
+  echo "$CUR" > "$MARKER"
+fi