chore(voyage): W3 hardening (S2) — exec-form hooks, enforced disallowed-tools, F2 decision

S2 of the 2.1.181 upgrade. Schemas verified verbatim against the official
slash-commands and hooks docs before editing (a first-pass camelCase
'disallowedTools' claim was caught and corrected to kebab-case against the doc).

- CC-14 (SHIP): migrate all 7 hooks in hooks/hooks.json to exec-form
  {command:"node", args:["${CLAUDE_PLUGIN_ROOT}/hooks/scripts/X.mjs"]}. Doc
  recommends exec-form whenever a hook references a path placeholder; protects
  consumers installing under a path with spaces. ${CLAUDE_PLUGIN_ROOT}
  interpolates inside args (verified). hooks-json-stop-wired test made
  form-agnostic (normalizes command+args to one invocation string).
- CC-11 (SHIP): add `disallowed-tools: Agent, TeamCreate` to trekexecute
  frontmatter, enforcing its documented "No Agent tool, no TeamCreate" rule.
  allowed-tools grants auto-approval but does NOT remove tools from the pool,
  so the prior omission left Agent callable; disallowed-tools removes it.
  trekexecute is the only command with a documented exclusion.
- CC-15 (DECIDE: keep universal): re-affirm F2 deferral. pre-bash/pre-write
  executors stay universal -- session-agnostic safety (rm -rf /, ~/.ssh, .env)
  that narrowing to execute-only would only weaken. Header comments corrected.
- CC-10 (DECIDE: design note, no code): no blanket Agent(model:opus) deny rule
  -- would break balanced/economy profiles; any model-enforcement must be
  profile-aware, deferred into W2. Folded into open question #3.

Matrix updated with S2 resolutions section. Tests 578 pass / 0 fail / 2 skip;
claude plugin validate passes (only pre-existing root-CLAUDE.md warning).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqBYc8Ltrk7LipyJmGxXiB

commands/trekexecute.md

@@ -4,6 +4,7 @@ description: Disciplined plan executor — single-session or multi-session with
 argument-hint: "[--project <dir>] [--fg | --resume | --dry-run | --validate | --step N | --session N] [plan.md]"
 model: opus
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
+disallowed-tools: Agent, TeamCreate
 ---
 
 # Ultraexecute Local
@@ -1606,7 +1607,10 @@ code-path.
 9. **Progress file is ground truth.** Resume uses the progress file, not git log.
 
 10. **No sub-agents.** The executor reads and implements directly.
-    No Agent tool, no TeamCreate, no delegation.
+    No Agent tool, no TeamCreate, no delegation. Enforced (not just
+    documented) via `disallowed-tools: Agent, TeamCreate` in the frontmatter,
+    which removes both tools from the pool — `allowed-tools` alone does not,
+    since omission leaves a tool callable (CC 2.1.152).
 
 11. **Worktree isolation is mandatory for parallel execution.** Every parallel
     `claude -p` session MUST run in its own git worktree. Never launch two or