Privacy perimeter (deny-by-default git hooks) + whole-vault graph lint + multi-source consolidation guide

Problem

The plugin's README promise is "keeps your data yours", and v1.7 closed multi-writer safety — but two gaps remain for anyone running a vault that contains data they would never publish (journals, client work, personal records):

1. No privacy boundary at the git layer. Nothing stops a sensitive file band or a well-formed identifier (national ID, secret, API key) from being committed and later pushed. Pattern scanning alone is insufficient (real data hides inside "examples" in templates), so the last line of defense has to be a deny-by-default gate at commit time, plus an optional air-gap for vaults that must never push at all.
2. No graph health check. wiki-lint covers frontmatter/orphan basics per page, but there is no whole-vault wikilink graph pass: broken links, broken up: hierarchy fields, orphan pages — with a way to accept legitimate dangling links (calendar dates, planned pages) so the signal stays clean.

There is also no documented methodology for the "consolidate several vaults into one" scenario, which is where both tools earn their keep.

Proposed change

Five patterns, battle-tested while consolidating four live vaults (~10k files) into one air-gapped vault. Two as code, three as a methodology guide:

#	Pattern	Shape
1	Privacy perimeter (deny-by-default)	bin/setup-perimeter.sh — opt-in installer for pre-commit (sensitive path globs + identifier/secret regex on added lines + false-positive whitelist) and pre-push (optional air-gap) git hooks. Config = three plain-text files under .vault-meta/. Single-shot overrides (PERIMETER_ALLOW=1). --check, --uninstall (backs up / restores pre-existing hooks).
2	Graph lint	scripts/graph-lint.py — stdlib-only wikilink graph check: broken links, broken up:, orphans (content vs _system), Obsidian-style resolution (basename + frontmatter aliases, inline and block styles), accepted-dangling whitelist, --json, --strict.
3	Hardened migration	docs: dry-run by default, SHA-256 manifest proof the source is untouched, scan-before-git add, index-only tier, anti-operator brakes (retype confirmation + cooldown).
4	Multi-source consolidation loop	docs: import (copy-forward) → dedup by normalized name (EOL-normalized diffs) → weave into MOCs/up: → graph-lint → commit per wave with a reversible map.
5	Merge governance	docs: dedup ledger with declared precedence + ssot: true, and a pending-decisions quarantine so human judgment never blocks the loop.

Both tools are opt-in, hermetic (no network, stdlib/POSIX only), and ship with hermetic test suites wired into make test.

Blast radius

• No existing file's behavior changes; both tools are new and opt-in.
• setup-perimeter.sh writes into .git/hooks/ — pre-existing hooks are backed up to <hook>.pre-perimeter.bak and restored on --uninstall; managed hooks carry a marker line so re-runs and uninstalls never touch user hooks.
• Makefile gains 2 test targets appended to make test.

A PR implementing this follows immediately (linked once open).