harden(hook): bound hook stdin reads

[thehoff]

Summary

• bound hook stdin reads with a 500ms deadline while preserving the 1 MiB cap
• keep Claude/Gemini fail-closed and Copilot/Cursor fail-open on read timeout
• document the hook stdin timeout contract

Tests

• cargo test --test hook_stdin_timeout -- --nocapture
• cargo test --test hook_claude_deny -- --nocapture
• cargo build --quiet
• git diff --check -- src/hooks/hook_cmd.rs docs/guide/architecture.md tests/hook_stdin_timeout.rs

Notes

• Lab issue 200 acceptance criteria are covered by the new integration test.
• The issue smoke command using a shell pipeline can still exit 124 because the left side sleeps after the hook exits; the hook itself emits timeout deny JSON after 500ms.