Problem

The block-unreviewed-merge.sh hook checks that .claude/session/reviews/<pr>-ceo.approved exists and its SHA matches HEAD. But Claude can write this marker directly via echo SHA > file without the user ever approving — bypassing the entire point of the merge gate.

Incident

PR me2resh/curios-dog#201 was merged with a CEO marker that Claude wrote without explicit user approval.

Proposed fix

The /approve-merge skill should write a signed marker instead of a plain SHA:

<sha>
approved_by=user
approved_at=<ISO-8601>
message_hash=<hash of the user's approval message>

The hook then verifies:

1. SHA matches HEAD (existing)
2. approved_by=user is present (new — raw echo won't include this)
3. Optionally: message_hash matches a recent user message (strongest guarantee)

This makes raw echo SHA > file insufficient to pass the gate — the marker must have the structured fields that only the skill writes after verifying user intent.