fix(hooks): memorable hook second-pass review fixes

- Trust-policy lookup fails closed on any git failure that is not 'no such
  remote' or 'not a git repository' (a corrupt or unreadable .git/config and
  dubious ownership exit 128 and used to read as 'no remote').
- pickAdditionalContext takes the first complete top-level JSON object, so a
  vendor whose background helper appends a line to stdout (or prints a banner
  first) does not lose its answer.
- The hook-errors.log rate limiter keys on a stable string (a vendor's
  timestamped stderr no longer defeats it); the log is chmod 0600 on every
  append because sibling hooks create the same file without a mode.
- Scan admission is sized by payload bytes (scan() is uninterruptible).
- The receipt payload class is a stable token; the prose moved to the docs.
- Header, constants and comments match the behaviour (silent skips vs logged
  refusals; HIGH/MEDIUM withholding; STAGE_CAP_MS scope; runExternal in the
  spawn-bin header; the ledger lock budget doc).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

hosts/claude/hooks/spawn-bin.ts

@@ -8,6 +8,10 @@
  *    is the correct conversion. (ENOENT before the bin ever ran.)
  * 2. `bin/gstack-*` are extensionless bash scripts. Windows has no shebang
  *    support, so they must be handed to bash explicitly.
+ *
+ * Also home to runExternal: the contained runner for EXTERNAL executables
+ * (third-party binaries a hook hands data to; see its doc comment). Unlike
+ * runBin it refuses win32, because its guarantee is process-group containment.
  */
 import * as fs from 'fs';
 import * as path from 'path';