chore(voyage): W3 hardening (S2) — exec-form hooks, enforced disallowed-tools, F2 decision

S2 of the 2.1.181 upgrade. Schemas verified verbatim against the official
slash-commands and hooks docs before editing (a first-pass camelCase
'disallowedTools' claim was caught and corrected to kebab-case against the doc).

- CC-14 (SHIP): migrate all 7 hooks in hooks/hooks.json to exec-form
  {command:"node", args:["${CLAUDE_PLUGIN_ROOT}/hooks/scripts/X.mjs"]}. Doc
  recommends exec-form whenever a hook references a path placeholder; protects
  consumers installing under a path with spaces. ${CLAUDE_PLUGIN_ROOT}
  interpolates inside args (verified). hooks-json-stop-wired test made
  form-agnostic (normalizes command+args to one invocation string).
- CC-11 (SHIP): add `disallowed-tools: Agent, TeamCreate` to trekexecute
  frontmatter, enforcing its documented "No Agent tool, no TeamCreate" rule.
  allowed-tools grants auto-approval but does NOT remove tools from the pool,
  so the prior omission left Agent callable; disallowed-tools removes it.
  trekexecute is the only command with a documented exclusion.
- CC-15 (DECIDE: keep universal): re-affirm F2 deferral. pre-bash/pre-write
  executors stay universal -- session-agnostic safety (rm -rf /, ~/.ssh, .env)
  that narrowing to execute-only would only weaken. Header comments corrected.
- CC-10 (DECIDE: design note, no code): no blanket Agent(model:opus) deny rule
  -- would break balanced/economy profiles; any model-enforcement must be
  profile-aware, deferred into W2. Folded into open question #3.

Matrix updated with S2 resolutions section. Tests 578 pass / 0 fail / 2 skip;
claude plugin validate passes (only pre-existing root-CLAUDE.md warning).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqBYc8Ltrk7LipyJmGxXiB

hooks/scripts/pre-write-executor.mjs

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
 // Hook: pre-write-executor.mjs
 // Event: PreToolUse (Write)
-// Purpose: Block writes to security-sensitive paths during plan execution.
+// Purpose: Block writes to security-sensitive paths. Wired universally (every
+//   Voyage session, not just execution) by deliberate decision — protecting
+//   ~/.ssh, ~/.aws, .git/hooks, .env, shell configs benefits every session.
+//   The CC if: path-scoping mechanism now works, but narrowing to execute-only
+//   would only weaken protection with no benefit. See cc-upgrade matrix CC-15/F2.
 //
 // Protocol:
 //   - Read JSON from stdin: { tool_name, tool_input }