Harden Tailtest hook runtime contract

[BananaAccurate]

Summary

This is a stacked hook-runtime contract branch built on PR #11's validation-gates line.

It includes earlier stack commits from PR #8, PR #10, and PR #11 because upstream main does not yet contain those prerequisites. The new commits in this branch are:

• 7e0aee8 — harden hook runtime contract
• 10c80d0 — validate restored hook state

Root cause

Tailtest's Codex hook runtime needed explicit hardening around plugin-root command resolution, SessionStart context injection, restored session-state trust boundaries, direct-clone hook installation, and shell-script line endings. Without these repairs, hooks could rely on brittle hard-coded paths, restore malformed project-local state, or fail under WSL because scripts/init.sh was not guaranteed LF.

Changes

• hooks/hooks.json now uses plugin-root based commands with Windows overrides and scoped matchers for SessionStart, PostToolUse, and Stop.
• SessionStart injects compact trusted runtime context from RUNTIME.md, never writes a project AGENTS.md, and keeps stdout valid JSON.
• Restored session data is validated and bounded before hook consumption, including contained relative paths for pending files and path-bearing maps.
• Resume falls back to startup orientation when .tailtest/session.json is empty or fully invalid.
• Direct-clone initializer materializes absolute project-scoped commands and preserves conflicting existing hook config as a sidecar.
• Added .gitattributes policy so scripts/*.sh stays LF; scripts/init.sh is LF in the worktree.
• Added focused manifest, initializer, resume, untrusted-data, and session-validation tests.

Validation

Run from C:\Users\enhal\.codex\worktrees\tailtest-hook-runtime-contract at 10c80d0:

• Windows: python -m pytest -q → exit 0, 423 passed in 47.23s
• Windows: python -m ruff check . → exit 0, All checks passed!
• Windows: python -m ruff format --check . → exit 0, 28 files already formatted
• Windows: git diff --check → exit 0
• WSL/Linux: python3 -m pytest -q && python3 -m ruff check . && python3 -m ruff format --check . → exit 0, 422 passed, 1 skipped, Ruff check passed, 28 files already formatted

Review loop evidence:

• Initial focused red tests: 9 failed, 2 passed
• First focused green tests: 11 passed
• Review found restored-state validation gaps.
• Fix-round red tests: 2 failed, 12 passed
• Fix-round focused green tests: 15 passed
• Scoped re-review found all blocking findings addressed.

Security notes

• Repository/session-derived values are labeled as untrusted JSON data before being surfaced as model context.
• Restored path-bearing values are realpath-contained under the active project root.
• Hook commands avoid hard-coded user home/source paths.
• Workflow from PR Add CI and satisfy Tailtest validation gates #11 remains unprivileged (contents: read, no pull_request_target).

Remaining limitation

This PR is stacked because upstream main does not yet contain the validation-gates and stale-queue prerequisites. Maintainer review/merge is still required, and GitHub may not run the newly added workflow until it exists on the base branch.