fix: fail closed on hook inspection errors

[johnson-ricon]

Summary

• make staged-path enumeration failures block both obfuscation and encryption hooks
• make staged encryption-attribute inspection failures block the encryption hook
• preserve NUL-delimited encrypted-path handling through checked temporary snapshots

Fix-it for adversarial review of #187. The process substitutions hid producer exit statuses, so Git inspection failures could look like empty staged sets and let the hooks succeed.

Validation

• focused obfuscation hook and integration suites: 53 passed
• full suite: 423 BATS and 9 Python passed
• all eight configured Codebase lints passed
• README generation, Bash syntax, and diff checks passed
• commit is GPG-signed by Johnson

The optional clone-local pre-commit hook is not installed.