test(hooks): hook-behavior harness, shellcheck CI, baseline cases (U15 — PR0, merge first)

[dralgorhythm]

Summary

U15 (PR0 lane) from plan_framework_hardening.md — the review's Critical finding: hooks were untested config. This PR makes hook behavior a tested surface and must merge FIRST; the hooks/invariants/gates lanes add their cases to it.

What changed

• scripts/test-hooks.sh — table-driven hook-behavior runner (report() idiom from check-invariants.sh); auto-sources scripts/hook-tests.d/*.sh case files (open/closed: later PRs ship cases as new files); path_without_jq shim for fail-open testing.
• scripts/hook-tests.d/00-baseline.sh — 11 characterization cases pinning current behavior of the five hooks the plan touches (advisory pre-commit context, explicit main-push deny, clean-tree silence, secret-write ask, normal-write allow, jq-absent fail-open sweep).
• Fixtures: dependency-free failing-project (node -e "process.exit(1)"), slow-gate (sleeps 8s).
• CI: new blocking shellcheck and hook-tests jobs (pinned SHAs, minimal permissions, matching house style).
• Fixed the named pre-existing shellcheck findings (dead VERIFICATION_COMMANDS + unused PY_MGR block; ls | wc -l → find), behavior pinned by the baseline cases.

Provenance

• Author: worker-builder (sonnet) via /swarm-execute; orchestrator independently re-ran both gates on the lane tip.
• Gates: check-invariants.sh 21/21 GREEN; test-hooks.sh 11/11 GREEN; shellcheck + actionlint + bash -n clean; harness teeth verified (deliberate wrong expectation fails the run).
• Risk tier: low — additive test infra + dead-code removal; no hook behavior change (characterization cases prove it).

Notes / follow-up

The shellcheck CI job excludes three pre-existing finding classes in scripts/ with an in-file comment (SC2319 — check-invariants' own idiom; SC2164; SC1087 in init-framework.sh). Follow-up unit should fix or formally except them.

🤖 Generated with Claude Code