[protonspy]

What changed

The unpushed-work line moved from the Stop hook to SessionStart.

• Stop now reports only scc validate findings.
• SessionStart says once, next to drift: "<branch> has N commits never pushed. When its work is done, deliver it per delivery.md: reviews, then push and the PR."

Why: on Stop, additionalContext keeps the conversation going, so the old line read as an order. It re-fired at the end of every turn spent waiting on reviews, on the user, or on a branch nobody wanted pushed yet. It also asked for a push before the reviews that delivery.md requires first.

Plan: plans/undelivered-at-session-start.md. Docs updated: docs/wiki/pages/hooks.md, the README, the stage descriptions in internal/hooks/harness.go, and the wiki changelog.

Verification

• scc validate --checks --pr exit 0: 1037 tests, coverage 86.4%, 0 findings.
• New test TestUnpushedWorkIsReportedAtSessionStartOnly.
• TestStopIsSilentWhileTheHarnessIsAlreadyContinuing needed something for Stop to report, and the unpushed line used to be it. Its fixture now uses a plan finding instead.
• golangci-lint run and fmt --diff are clean.

Reviews

• scc-code-review: clean. Of its two minor nits, the stale emitHook comment is fixed. An overlong README line is left as is (cosmetic).
• scc-security-review: clean, no findings. The branch name no longer appears inside an executable command in agent context.