feat: analyze bundled hook execution surfaces - #404

Requesting changes because the new hook-flow model has several deterministic false negatives for credential/event-data exfiltration and several blocking false positives. The focused analyzer suite passes, so these behaviors need explicit regression cases before the model can safely drive BH2 install blocking.

[SkillSpector Review]

The current-main conflict is resolved at 4c06d7d by retaining #429's already-merged BH3 additions; the resolved tree is byte-for-byte identical to current main. I resolved the four threads whose requested behavior is now satisfied (|&/|| are explicitly unmodeled, the dig .env and tuple-unpack false positives are gone, and loopback classification uses one normalizer).

Still requesting changes for the five remaining data-flow cases: shell parameter expansion, event stdin through command substitution, aws s3 cp - stdin semantics, sys.stdin.buffer.read(), and local Python-import traversal. Exact current-tree reproductions emit BH1 only with payload_analysis_level="unmodeled", but the ledger remains COMPLETED; the acceptance path can therefore report analysis complete and recommend SAFE without analyzing the payload. Please either model these flows or make unmodeled payload analysis incomplete/fail closed, with exact regressions.

Because merged #429 already subsumes #404 plus BH3, closing #404 as superseded and fixing this behavior on main in a focused follow-up may be cleaner.

[SkillSpector Review]

Re-review at dbfb033: merging current main leaves zero file changes; the head tree is byte-for-byte identical to d3a849a. The five previously requested flows remain unaddressed: shell parameter expansion, event stdin through command substitution, aws s3 cp - stdin, sys.stdin.buffer.read(), and local Python-import traversal each emit BH1 only with payload_analysis_level="unmodeled" while the ledger reports COMPLETED. The focused 113-test suite and hosted checks pass, but this fail-open behavior remains. Still requesting changes. Since #429 already landed this tree, close #404 as superseded and address the behavior in a focused follow-up instead of merging a no-op PR.

[SkillSpector Review]

Re-review of 8146c18: the current head only merges main and the PR now has an empty diff. It therefore does not provide a PR-owned change that resolves the five previously reported unmodeled hook payload flows (shell parameter expansion, event stdin through command substitution, aws s3 cp -, sys.stdin.buffer.read(), and local Python-import traversal). The existing action items remain open even though hosted checks are green. This PR has been superseded by the already-landed hook work; please close it and address any remaining fail-open completeness behavior in a focused follow-up.

[SkillSpector Review]

Re-reviewed current head 39995d5af6d90b6b1276d1830d9d9e24c80598a2. The new head only synchronizes main; GitHub still reports an empty PR diff, so there is no PR-owned change to reassess and none of the five outstanding hook payload flows is fixed here: shell parameter expansion, event stdin through command substitution, aws s3 cp - stdin, sys.stdin.buffer.read(), and local Python-import traversal remain unmodeled while completeness can still be reported as completed.

All hosted checks pass, but this no-op PR is superseded by the hook work already merged through #429. Please close it and address any remaining fail-open completeness behavior in a focused follow-up with regressions. The existing threads contain the exact cases, so I have not duplicated them. The unresolved action items and BEHIND merge state prevent approval and merge.