fix(hooks): resolve #73 #74 #75 follow-ups (test harness, path handling, set -euo)

[5uck1ess]

Summary

Bundles the three hook follow-up issues from the #72 review, since the fixes and tests cluster in the same files. Closes #73, #74, #75.

#73 — run_hook dead exit-code check

hooks_test.sh had OUTPUT=$(…) || true followed by EXIT=$?, so $? always saw true's rc=0 and every run_hook caller's exit-code assertion was dead code. The suite runs under set -uo pipefail (no -e), so the || true was unnecessary cargo — dropping it restores the real hook exit code. Every existing run_hook call already expects exit 0 and still passes, so no assertions needed tightening.

#74 — post-validate.sh path handling + test coverage

Normalize both REPO_ROOT and the constructed ABS_PATH through a portable realpath pipeline before the glob match:

• REPO_ROOT → canonicalized via cd && pwd -P (fixes symlinked-repo false positives).
• ABS_PATH → python3 → python → cd dirname && pwd -P → pure-sed ./.. collapse. The sed tier is the safety net when python is absent and the parent dir doesn't exist yet (pre-mkdir writes, fixtures).
• TMPDIR allowlist extended with /private/var/folders/* because python's realpath resolves /var → /private/var on macOS.

Four new tests pin all four scenarios called out in the issue:

• cwd is a subdirectory, file_path=../in-repo.md → no warning
• cwd is repo root, file_path=../outside/foo.go → warn (pins edge case Add scrape command, Jina Reader integration, enhanced PR pipeline #1)
• /var/folders/xx/foo.go → no warning (pins the TMPDIR allowlist)
• cwd reached via symlink → no warning (pins edge case Align Codex and Gemini to plugin-first with CLI fallback #2)

#75 — three cleanup items

1. security-patterns.sh — set -euo pipefail with || true guards on every jq assignment and the dedup echo >> SEEN_FILE, matching the pattern established in rtk-rewrite.sh. (post-validate.sh already had it.)
2. Per-pattern dedup test — second assertion fires a different pattern (eval() on the same file used by the existing pickle dedup test. Guards against a key-collapse regression that would flatten dedup to "warn-once-ever".
3. rtk-rewrite rc 3 + rewrite == input test — new shim mode ask-noop-rewrite exercises the intersection of the ask-suppression branch and the identity-rewrite guard.
4. Comment trims — replace "pins the $$→$PPID fix" / "Pins the realpath -m GNU-ism fix…" archaeology with invariant phrasing. The dedup-test $() topology comment stays (it prevents a real future bug).

Windows / Git Bash compatibility

Second commit adds:

• Drive-letter absolute-path detection (C:\foo / C:/foo) in addition to /foo.
• python3 → python → cd/pwd → sed fallback chain so the fix works even on minimal Git Bash without python.
• Symlink test skips cleanly (prints a SKIP: line) when ln -s can't create a real symlink (Windows Git Bash without developer mode, some FUSE mounts).

Verified the sed fallback manually by shadowing python3 and python with /bin/false: in-repo paths pass silently, ../outside paths warn, absolute outside paths warn. On macOS.

Test plan

• bash hooks/hooks_test.sh → 70 passed, 0 failed on macOS
• Manual sed-fallback verification with python shadowed to /bin/false
• CI run on Linux (pending)
• Manual smoke on Windows Git Bash (deferred — the symlink test is guarded to skip cleanly if ln -s is restricted)