improvement: migrate enforcement hooks to plugin package hooks/hooks.json

[Luis85]

Context

Part of the plugin audit in #444 (§3, R1 — highest-impact finding). Two active enforcement hooks live in .claude/settings.json (project-local only). When adopters install Specorator as a plugin, neither hook is bundled — branch protection and memory reminders require manual setup. This is the single largest adopter experience gap.

Current hooks to migrate

Hook 1 — SessionStart: memory reminder

{
  "matcher": "*",
  "hooks": [{"type": "command", "command": "test -f .claude/memory/MEMORY.md && echo '[memory] Read ...' || true"}]
}

Hook 2 — PreToolUse: branch guard (Python-based)

{
  "matcher": "Bash",
  "hooks": [{"type": "command", "command": "... [Python guard blocking commits to main/develop] ..."}]
}

Work

1. Create claude-plugin/specorator/hooks/hooks.json with both hooks migrated
2. Update scripts/build-claude-plugin.ts to copy/generate hooks/hooks.json into the plugin package
3. Verify the exit-code semantics are correct (2 = blocking, 1 = non-blocking — see research: Claude plugin developer best-practices audit — gaps, standards, refactor opportunities #444 §3)
4. Update scripts/check-claude-plugin.ts to validate hooks/hooks.json presence (or defer to the validator ticket)

Important: exit code semantics

Exit code 2 = blocking. Exit code 1 = non-blocking (execution continues). This inverts standard Unix convention. The branch guard must use exit 2 to block — not exit 1.

Definition of Done

• claude-plugin/specorator/hooks/hooks.json exists with both hooks
• build:claude-plugin copies hooks file into generated package
• Branch guard exits 2 (not 1) on violation
• check:claude-plugin validates hooks presence (or tracked in separate validator issue)
• Adopter installing plugin gets hooks automatically
• Verify gate green

References

• Parent audit: research: Claude plugin developer best-practices audit — gaps, standards, refactor opportunities #444 §3
• Hook event lifecycle: https://code.claude.com/docs/en/hooks
• Hook security notes: research: Claude plugin developer best-practices audit — gaps, standards, refactor opportunities #444 §3 (Lasso Security, CVE-2025-54795)
• Validator gap: companion issue for check:claude-plugin extension