Add E2E integration test for devkit_start -> guard block -> advance -> unblock

[5uck1ess]

Problem

PR #64 (#63) added strong unit + fixture coverage:

• Go unit tests for SessionState.UpdatedAt bump, stale reclaim, TTL boundary
• Shell fixture matrix for devkit-guard.sh across command/prompt × hard/soft × fresh/stale (27 cases)
• hooks_test.sh smoke suite (46 cases)

What's missing: a full end-to-end integration test that drives the real engine binary through the complete enforcement loop. Nothing currently verifies that devkit_start + devkit-guard.sh + devkit_advance compose correctly against the real session.json the engine writes.

Proposal

Add a test (Go or bash, TBD) that:

1. Builds the devkit-engine binary via go build ./src.
2. Spawns it as an MCP server subprocess.
3. Sends devkit_start for a fixture workflow.
4. Invokes hooks/devkit-guard.sh with a synthetic Write-tool PreToolUse payload, asserts exit 2.
5. Sends devkit_advance.
6. Invokes the guard again with the same payload, asserts exit 0 (step has progressed — whatever the new step allows).
7. Completes the workflow and asserts session cleanup.

Acceptance criteria

• New test file hooks/integration_test.sh or src/mcp/guard_integration_test.go.
• Runs in CI alongside existing hook-smoke-tests and build-and-test jobs.
• Covers at least: prompt+hard blocks Write → advance → next step allows Write OR workflow complete.
• Runs under ~30s so it doesn't slow CI meaningfully.

Also worth including

• Concurrency test: two concurrent devkit_start calls against a stale session — assert only one wins (per the flock CAS in src/mcp/tools.go).
• DEVKIT_SESSION_STALE_TTL_SECONDS env override exercise — set to 1 second, sleep 2, assert reclaim.
• step_label fallback coverage — session missing current_index/total_steps, assert the veto message still names the workflow.

Context

Flagged by pr-test-analyzer during the PR #64 mega-review. Existing tests are strong at the unit level but nothing exercises the composed system. Medium priority — the individual pieces are well-tested, and this would catch wiring regressions.

[5uck1ess]

Closing as speculative. Filed by the assistant during PR #64's mega-review as a nice-to-have. Unit + fixture coverage is already strong (Go unit tests, shell fixture matrix, hooks_test smoke suite). No real wiring regression has been observed. Reopen if one happens.