fix: register Claude hooks without a shell

[DeusData]

Fixes #1733

Summary

• register all seven managed Claude Code hooks with the executable-plus-arguments form, preserving the configured binary path literally and forwarding hook input directly on stdin
• migrate legacy shell registrations and a previously managed executable path while requiring exact command-and-arguments ownership, so foreign hooks that share a matcher remain untouched
• use the resolved install target during uninstall, including custom install directories and consistent Windows path spelling
• add deterministic unit and product regressions for the shared PreToolUse, PostToolUse, SessionStart, and SubagentStart behavior

Design choice

The recommended native executable-plus-arguments form was selected because it has the smallest parser surface: Claude Code launches the binary directly, the path remains one literal value across native Windows and Git Bash, and stdin remains noninteractive.

Alternatives considered:

• retaining the command-shell wrapper would preserve the older settings shape, but still crosses incompatible shell parsers and can reinterpret Windows switches or paths
• adding a PowerShell wrapper would avoid part of the command-shell mismatch, but introduces another shell grammar and another runtime artifact
• generating shell-specific commands would multiply platform branches and still leave ownership and quoting behavior dependent on the launching shell

Trade-offs:

• this relies on the supported Claude Code hook arguments field
• managed helper scripts remain installed and migration-aware for upgrade and uninstall compatibility even though the new Claude Code settings execute the binary directly
• ownership is intentionally exact; hooks not matching both the managed command and arguments are preserved

Verification

• deterministic current-main regression: the new cross-shell contract failed on the screened base
• lifecycle regression: custom-directory install followed by matching uninstall failed before the follow-up fix; final production-only revert returned exactly that test to red
• final sanitized CLI suite: 283 passed, 0 failed
• direct product test: isolated daemon/index/search control passed and direct executable argv plus stdin emitted hook-specific output
• Python syntax check passed
• make -j2 -f Makefile.cbm lint-ci passed
• Windows cross-build and Wine smoke passed
• full macOS local CI on the pre-lifecycle-review tree: 7,584 passed, 0 failed, 8 skipped
• Linux arm64 local CI on the pre-lifecycle-review tree: 7,422 passed, 0 failed, 8 skipped

The final lifecycle correction was revalidated by the full sanitized CLI suite, product test, lint, and Windows cross/Wine leg. The real-Windows VM leg could not run because the local CI infrastructure lacked the VM SSH host key; no infrastructure bypass was attempted.