fix: quote SessionStart hook path

[Bortlesboat]

Summary

• quote the CLAUDE_PLUGIN_ROOT expansion in the SessionStart hook command
• add a regression check that locks the hook command string in hooks/hooks.json

Verification

• hooks/session-start-test.sh passed from an LF-normalized temp checkout on Windows
• executed the SessionStart hook command from a temp path containing spaces and confirmed it returned the expected JSON payload

Closes #214.