chore(sync): cascade fleet template@48ea8b4

Auto-applied by socket-wheelhouse sync-scaffolding into socket-registry.
5 file(s) touched:
  - .claude/hooks/no-underscore-identifier-guard/README.md
  - .claude/hooks/no-underscore-identifier-guard/index.mts
  - .claude/hooks/setup-security-tools/lib/installers.mts
  - .config/oxlint-plugin/rules/sort-boolean-chains.mts
  - docs/claude.md/fleet/tooling.md

Author: jdalton

.claude/hooks/no-underscore-identifier-guard/README.md

@@ -6,21 +6,21 @@ underscore-prefixed **identifier** (`_resetX`, `_internal`, `_cache`, etc.).
 ## Why
 
 Privacy in TypeScript is handled by module boundaries (not exporting) or by
-the `_internal/` *directory* pattern — not by leading underscores on symbol
+the `_internal/` _directory_ pattern — not by leading underscores on symbol
 names. The underscore-as-internal-marker convention is borrowed from other
 languages where it has runtime meaning; in TS it's purely decorative and
 adds noise to `git blame` and IDE autocomplete.
 
 ## What's banned
 
-| Form | Example |
-| --- | --- |
-| Variable | `const _cache = new Map()` |
-| Function | `function _doResolve() {}` |
-| Class | `class _Helper {}` |
-| Interface | `interface _Options {}` |
-| Type alias | `type _Internal = ...` |
-| Re-export | `export { _foo }` |
+| Form       | Example                    |
+| ---------- | -------------------------- |
+| Variable   | `const _cache = new Map()` |
+| Function   | `function _doResolve() {}` |
+| Class      | `class _Helper {}`         |
+| Interface  | `interface _Options {}`    |
+| Type alias | `type _Internal = ...`     |
+| Re-export  | `export { _foo }`          |
 
 ## What's allowed
 

.claude/hooks/no-underscore-identifier-guard/index.mts

@@ -175,9 +175,7 @@ async function main(): Promise<void> {
   }
 
   const text =
-    payload.tool_input?.content ??
-    payload.tool_input?.new_string ??
-    ''
+    payload.tool_input?.content ?? payload.tool_input?.new_string ?? ''
   if (!text) {
     process.exit(0)
   }

.config/oxlint-plugin/rules/sort-boolean-chains.mts

@@ -2,30 +2,26 @@
  * @file Sort all-identifier boolean chains alphanumerically. Per CLAUDE.md
  *   "Sorting" rule, a chain like `agentshieldOk && zizmorOk && sfwOk` reads
  *   with the identifier names in alpha order: `agentshieldOk && sfwOk &&
- *   zizmorOk`. The runtime is short-circuit-insensitive to operand order
- *   *when every operand is a plain identifier* (no calls, no member access
- *   with getters) — so reordering doesn't change semantics. Sorting reduces
- *   diff churn when adding a new flag and makes "is everything ready?"
- *   checks visually consistent.
+ *   zizmorOk`. The runtime is short-circuit-insensitive to operand order _when
+ *   every operand is a plain identifier_ (no calls, no member access with
+ *   getters) — so reordering doesn't change semantics. Sorting reduces diff
+ *   churn when adding a new flag and makes "is everything ready?" checks
+ *   visually consistent. Detects: chains of `&&` or `||` whose operands are ALL
+ *   bare Identifiers (length ≥ 2, no duplicates, uniform operator across the
+ *   flattened chain). Skipped (not reported, autofix-safe stays narrow):
  *
- *   Detects: chains of `&&` or `||` whose operands are ALL bare Identifiers
- *   (length ≥ 2, no duplicates, uniform operator across the flattened chain).
- *
- *   Skipped (not reported, autofix-safe stays narrow):
- *
- *   - Any operand isn't a bare `Identifier` (Calls / member-access / literals
- *     / negations / nested non-uniform logical exprs short-circuit, and a
+ *   - Any operand isn't a bare `Identifier` (Calls / member-access / literals /
+ *     negations / nested non-uniform logical exprs short-circuit, and a
  *     `getter` on a member-access can have side effects — reordering would be
  *     observable).
  *   - Duplicate identifiers in the chain (rare, but rewriting through the
  *     duplicate would silently drop one).
  *   - Comments live between operands (autofix would relocate them).
- *   - Chain length < 2 (nothing to sort).
- *
- *   Why a separate rule from sort-equality-disjunctions: that rule sorts the
- *   right-hand string-literal of an equality chain (`x === 'a' || x === 'b'`);
- *   this rule sorts the bare-identifier operands of a pure-identifier chain.
- *   Structurally different ASTs, semantically different safety arguments.
+ *   - Chain length < 2 (nothing to sort). Why a separate rule from
+ *     sort-equality-disjunctions: that rule sorts the right-hand string-literal
+ *     of an equality chain (`x === 'a' || x === 'b'`); this rule sorts the
+ *     bare-identifier operands of a pure-identifier chain. Structurally
+ *     different ASTs, semantically different safety arguments.
  */
 
 /**
@@ -57,9 +53,9 @@ const rule = {
       : context.sourceCode
 
     /**
-     * Flatten a left-associative LogicalExpression chain into leaf nodes.
-     * `(a && b) && c` and `a && (b && c)` both flatten to [a, b, c]. Caller
-     * checks operator uniformity.
+     * Flatten a left-associative LogicalExpression chain into leaf nodes. `(a
+     * && b) && c` and `a && (b && c)` both flatten to [a, b, c]. Caller checks
+     * operator uniformity.
      */
     function flatten(node: AstNode, op: string, out: AstNode[]): void {
       if (node.type === 'LogicalExpression' && node.operator === op) {