fix(hook): drain stdin on early return, handle EPIPE in bridges

[arr-wf]

Summary

When ctxcop is paused (or an off switch is set), hook handlers return before reading stdin. A bridge that writes a payload larger than the pipe buffer (~64KB) gets EPIPE, and with no stdin error handler Node throws an unhandled error event that crashes the host. Seen in pi with a 400KB provider payload.

The drain now happens once in cmdHook, after the handler replies, so every harness is covered and new handlers cannot regress it. It is skipped when stdin is a terminal and for aider, which has no stdin hook. The pi and opencode bridges also get a stdin error handler, so an early-exiting hook fails open.

Affected handlers: all three pi handlers, plus 13 in the claudecode, codex, cursor and opencode adapters.

Test plan

• go test -race -count=1 ./... passes (run with an isolated HOME, see notes)

• gofmt -w . is clean

• go vet ./... is clean

• TestPausedHooksDrainStdin builds the binary, pauses via a temp HOME, and writes 400KB to a pipe for 15 hook events across all harnesses. Without the drain, 14 of 15 fail with broken pipe (Claude Code pre-tool-use reads stdin first).

• TestBridgeSurvivesEarlyExitHook (pi and opencode) runs the shipped bridge in node against a fake hook that exits unread. Each fails with write EPIPE ... Unhandled 'error' event when its bridge fix is reverted.

• Ran the built binary in a real terminal pane while paused: a terminal on stdin returns immediately, and 400KB piped in exits 0 and returns {}.

Security checklist

• This PR does not change detection or bypass surface.
• No new third-party Go dependency.
• No new third-party GitHub Action.
• No literal credential-shape strings in source outside fixture paths.
• Audit-log entries: N/A. The change adds no block, redact, or warn decision path.

Reviewer notes

• With the real HOME and ctxcop paused, the existing redaction tests in the harness packages fail because they read the live pause sentinel. They pass with an isolated HOME. Not fixed here; separate follow-up.
• The node bridge tests need a Node that strips TypeScript types by default (v24). They skip when node is missing.
• The Claude Code, Codex and Cursor apps spawn the hook themselves. This PR covers the hook binary side only.
• Follow-up: integration tests for hook binaries and bridges in GitHub Actions.

🤖 Generated with Claude Code

[linear-code]

SECOPS-1421

SECOPS-1422