trace: expand same-call attribution beyond foreground Claude Bash #3701

Context

Follow-up to #3625 and PR #3631. The PR is intentionally scoped to a foreground native Claude Code Bash call, following maintainer review.

It currently uses Claude Code's hook input update mechanism to export an opaque call token into the command before Git hooks run.

Scope

Investigate and implement broader runtime support for same-call commit attribution:

• background Bash calls whose process can outlive PostToolUse;
• coexistence with another hook that also rewrites updatedInput;
• narrow Bash permission matchers that can behave differently after command rewriting;
• Cursor, OpenCode, and other providers that do not expose the same pre-execution command-rewrite contract;
• explicit capability reporting when exact call correlation is unavailable.

Expected behavior

Every supported provider/runtime has a documented, tested way to correlate a Git hook with the exact command call that made the staged change. Unsupported combinations fail visibly or remain explicitly documented as unsupported instead of silently losing attribution.

Acceptance criteria

• Background-call lifecycle and snapshot retention are defined and tested.
• Multiple input-rewriting hooks have deterministic composition or a documented incompatibility.
• Narrow permission configurations retain their intended behavior.
• Each provider's capability matrix entry matches observable support.
• Unsupported runtimes surface a clear limitation or warning.
• Integration tests cover every provider/runtime combination declared supported.