fix: add PATH to restricted hook env, protect HOME/CLAUDE_PROJECT_DIR from allowlist override, reset plugin hooks state in tests

- P1: When allowedEnvVars is provided, PATH was missing from the base
  restricted env, causing non-builtin commands to fail at exec time
- P2: Allowlisted HOME/CLAUDE_PROJECT_DIR could overwrite normalized
  values from getHomeDirectory()/cwd with ambient process.env values
- P2: Test suite mutated shared pluginHooksState singleton without
  resetting it in afterEach, causing cross-test state leaks

src/hooks/claude-code-hooks/config.test.ts

@@ -94,11 +94,12 @@ function getStopCommands(config: Awaited<ReturnType<typeof loadClaudeHooksConfig
 }
 
 describe("mergePluginHooksConfigs", () => {
-  const { mergePluginHooksConfigs, setPluginHooksConfigs, clearClaudeHooksConfigCache: _clearCache } = require("./config")
+  const { mergePluginHooksConfigs, setPluginHooksConfigs, clearClaudeHooksConfigCache: _clearCache, resetPluginHooksState } = require("./config")
   const { setAdditionalAllowedMcpEnvVars, resetAdditionalAllowedMcpEnvVars } = require("../../features/claude-code-mcp-loader/configure-allowed-env-vars")
 
   afterEach(() => {
     resetAdditionalAllowedMcpEnvVars()
+    resetPluginHooksState()
   })
 
   test("#given empty plugin hooks #when merged #then returns base unchanged", () => {
@@ -246,7 +247,7 @@ describe("mergePluginHooksConfigs", () => {
 })
 
 describe("setPluginHooksConfigs", () => {
-  const { setPluginHooksConfigs, loadClaudeHooksConfig, clearClaudeHooksConfigCache: _clearCache } = require("./config")
+  const { setPluginHooksConfigs, loadClaudeHooksConfig, clearClaudeHooksConfigCache: _clearCache, resetPluginHooksState } = require("./config")
   const { resetAdditionalAllowedMcpEnvVars } = require("../../features/claude-code-mcp-loader/configure-allowed-env-vars")
   let originalWorkingDirectory = ""
 
@@ -258,6 +259,7 @@ describe("setPluginHooksConfigs", () => {
   afterEach(() => {
     _clearCache()
     resetAdditionalAllowedMcpEnvVars()
+    resetPluginHooksState()
     process.chdir(originalWorkingDirectory)
   })
 

src/hooks/claude-code-hooks/config.ts

@@ -108,6 +108,10 @@ export function clearClaudeHooksConfigCache(): void {
   configCache.clear()
 }
 
+export function resetPluginHooksState(): void {
+  pluginHooksState.clear()
+}
+
 function mergeHooksConfig(
   base: ClaudeHooksConfig,
   override: ClaudeHooksConfig