fix(hooks): resolve security eval and session-start output schema

[googlarz]

Summary

Fixes two issues surfaced in #106 and #110.

Fix #106 — eval injection vector in simplify-ignore-test.sh (Critical)

eval "$(sed -n '/^filter_file()/,/^}/p' hooks/simplify-ignore.sh)" extracted and eval'd a function at test-runner startup. Any future modification to simplify-ignore.sh that placed malicious content in or near filter_file would execute without review, since test runners are read with low suspicion.

Fix: restructured simplify-ignore.sh so it is safe to source:

• All helper functions (hash_cmd, file_id, block_hash, escape_glob, filter_file) come first
• A BASH_SOURCE guard immediately follows — sourcing stops here, so no jq check, no INPUT=$(cat), no stdin blocking
• Hook execution logic (jq check, stdin read, dispatch) runs only when the script is executed directly
• CACHE uses ${CACHE:-...} so callers (e.g. tests) can override via an exported variable

simplify-ignore-test.sh now sources the file with . hooks/simplify-ignore.sh — clean, no eval.

All 21 tests pass.

Fix #110 — session-start.sh uses undocumented JSON output schema

{"priority": "IMPORTANT", "message": "..."} uses fields that don't exist in the Claude Code hook schema. When CC receives JSON starting with { but with unrecognized fields, it silently ignores them — the meta-skill content was never injected.

Claude Code docs define two valid SessionStart output shapes:

1. Plain text stdout — injected directly as additional context ✓
2. {"hookSpecificOutput": {"additionalContext": "..."}} — correct structured schema, but broken for plugin-registered hooks (CC bug #16538 silently drops plugin SessionStart additionalContext)

Fix: switch to plain text stdout (shape 1), which works reliably for both native and plugin hooks. jq dependency removed.

Test plan

• bash hooks/simplify-ignore-test.sh — 21/21 pass
• bash hooks/session-start.sh — outputs plain text with meta-skill content
• Codex review — clean pass, no findings

Fixes #106, #110