Complete Tailtest runtime hardening

[BananaAccurate]

Root cause

The stacked Tailtest repair branch fixed the clean-Git mtime false positive, then further review identified adjacent hardening gaps: hook launch commands and automatic Git probes depended on ambient executable lookup from untrusted project directories, Stop defer authority accepted some data-like text too broadly, malformed hook payloads could crash SessionStart/PostToolUse, and the direct-clone initializer could execute project-local helpers (python3, python, cygpath, or related shell helpers) when a project path appeared first on PATH.

Change

• Keeps the PR17 clean-Git mtime fix: Tailtest now uses unstaged diff, staged diff, and untracked-file evidence instead of broad porcelain status for require_git_change=True sweeps.
• Adds trusted executable resolution for automatic Git probes so project-contained git shims and relative PATH entries are not selected.
• Runs bundled hook commands from the trusted plugin root while preserving the original project cwd through TAILTEST_PROJECT_CWD.
• Updates the direct-clone initializer to materialize the same hardened absolute hook command shape.
• Hardens scripts/init.sh helper resolution so relative PATH entries, project-contained PATH entries, project-local helper shims, and project-contained symlink targets are not executed.
• Keeps initializer symlink resolution portable by using plain readlink/greadlink when available, without GNU-only readlink -f or -- assumptions.
• Makes SessionStart, PostToolUse, and Stop resolve project root as event.cwd, then TAILTEST_PROJECT_CWD, then process cwd.
• Normalizes malformed/non-mapping hook payloads and non-mapping PostToolUse tool_input to safe empty dictionaries before field access.
• Tightens Stop defer/no-more-tools handling so indented or data-like directive text remains inert.
• Pins GitHub Actions and Python validation dependencies used by CI without changing the Windows/Ubuntu matrix.
• Adds regression coverage for executable resolution, Windows hook command lookup, direct initializer output, clean Git mtime churn, Stop defer authority boundaries, malformed hook payloads, and direct-clone initializer project-PATH spoofing.

Validation

Validated at head 6af8902289e968e9990e6b869a37245b4766faf8:

• RED regression on vulnerable 340ce256f64f16b20a5ee742094bba4641b46ef1: applying only the new initializer project-PATH test failed with fake-python3-ran; temporary red worktree was removed.
• Focused initializer suite: python -m pytest -q tests/test_hooks_manifest.py -- 12 passed, 1 skipped in 45.89s on Windows.
• Focused POSIX readlink regression under WSL: python3 -m pytest -q tests/test_hooks_manifest.py::test_initializer_tolerates_non_gnu_readlink tests/test_hooks_manifest.py -- 8 passed, 5 skipped in 6.47s.
• Windows full suite before the final POSIX-only test-routing commit: python -m pytest -q -- 458 passed, 1 skipped in 82.75s; python -m ruff check .; python -m ruff format --check .; git diff --check -- all passed.
• WSL/Linux full suite before the final POSIX-only test-routing commit: python3 -m pytest -q && python3 -m ruff check . && python3 -m ruff format --check . -- 452 passed, 7 skipped in 27.11s; Ruff check passed; 30 files already formatted.
• Fork CI for exact pushed head 6af8902: https://github.com/BananaAccurate/tailtest-codex/actions/runs/30516204249 -- success on windows-latest and ubuntu-latest.
• Focused SDD review loop for initializer PATH hardening: initial review found a readlink -f portability issue; fix rounds addressed GNU -f, symlink fallback, and GNU -- concerns; final scoped re-review marked all findings addressed with no new Critical/Important breakage.
• Prior hardening review loop for malformed payloads: SDD task review found one malformed-payload gap; fix commit eefbecb plus format commit 340ce25 were scoped re-reviewed clean.
• Action pin verification: git ls-remote confirmed actions/checkout v7.0.1 resolves to 3d3c42e5aac5ba805825da76410c181273ba90b1 and actions/setup-python v7.0.0 resolves to 5fda3b95a4ea91299a34e894583c3862153e4b97.

Security scan status

• Previous Codex Security scan 89e2182d-4590-40fe-9950-c1b7cf6eedde found confirmed initializer issue cand_init_path_exec_001 at stale head 340ce256f64f16b20a5ee742094bba4641b46ef1.
• This PR head now includes the repair commits 7e01bc7, dd9691f, 31b76b5, 9f60954, and follow-up test-routing commits through 6af8902.
• A fresh repaired-head Codex Security setup was opened for range 61132f9e6c4f9703ec707d7bf0d561fa49e64a2a..9f609542969fdb7706b40ef68a5a4544e86cae19, but await_codex_security_scan_start timed out waiting for setup Start. Repaired-head scan completion is therefore BLOCKED/UNVERIFIED, not claimed as pass.

Safety boundaries

• This branch remains stacked on earlier Tailtest repair PRs because upstream main still lacks the prerequisite hook/runtime fixes.
• Maintainer edits are enabled.
• No upstream merge, release, tag, repository-setting change, auth change, or runtime configuration change is claimed here.
• GitHub reports no status checks on the upstream PR object at the time of update; fork CI above is the current GitHub CI evidence for the pushed head.
• Current authenticated account has upstream READ permission only, so upstream merge/tag/release remain authority-blocked.