fix(hooks): memorable hook second-pass review fixes

- Trust-policy lookup fails closed on any git failure that is not 'no such
  remote' or 'not a git repository' (a corrupt or unreadable .git/config and
  dubious ownership exit 128 and used to read as 'no remote').
- pickAdditionalContext takes the first complete top-level JSON object, so a
  vendor whose background helper appends a line to stdout (or prints a banner
  first) does not lose its answer.
- The hook-errors.log rate limiter keys on a stable string (a vendor's
  timestamped stderr no longer defeats it); the log is chmod 0600 on every
  append because sibling hooks create the same file without a mode.
- Scan admission is sized by payload bytes (scan() is uninterruptible).
- The receipt payload class is a stable token; the prose moved to the docs.
- Header, constants and comments match the behaviour (silent skips vs logged
  refusals; HIGH/MEDIUM withholding; STAGE_CAP_MS scope; runExternal in the
  spawn-bin header; the ledger lock budget doc).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

lib/egress-receipt.ts

@@ -151,8 +151,10 @@ function requireString(value: unknown, name: string): string {
 }
 
 /**
- * mkdir spin lock, ~2.5s budget. Egress events are rare (minutes apart); the
- * lock only protects the read-last-line → append window.
+ * mkdir spin lock; the budget defaults to LEDGER_LOCK_BUDGET_MS (2.5 s) and
+ * callers on their own deadline pass less. Egress events are usually rare
+ * (minutes apart; the memorable hook is the per-prompt exception); the lock
+ * only protects the read-last-line → append window.
  *
  * Stale-lock reclaim: a crashed writer strands the lock dir. Once the spin
  * budget is exhausted, a lock dir whose mtime is >10s old is stale by