perf: faster hooks, diff, Codex and recovery fixes (follow-up to #12)

[maxgfr]

Follow-up to #12. I audited every finding against 0.6.0 and found a few gaps. Profiling also found two costs paid on every call. The branch then went through a two-axis review (standards, spec), and its findings are fixed here.

Performance

Each hook is a new process, so the fixed cost of every call matters most.

• Foundation no longer loads at startup. Through dispatch2, ctrlc linked Foundation and the Objective-C runtime. Loading them cost about 0.6 ms on every invocation, even for hooks that compress nothing. SIGINT, SIGTERM and SIGHUP now set the cancellation flag through a direct sigaction with SA_RESTART, replacing whatever disposition the caller left, as ctrlc's set_handler did. Non-Unix builds keep ctrlc.
• Cheaper regex compilation. The compact-v3 patterns used Unicode \s, \d and case folding, which their ASCII vocabulary doesn't need. Compiling them took about 1.1 ms; it now takes about 0.5 ms. Java frames keep Unicode \w, and a test pins that.

Measured on macOS arm64:

	0.6.0	this branch
hook, small output	2.7 ms	2.1 ms
hook, cargo test output	4.6 ms	3.4 ms
bench/performance.py --stress		−3 % to −19 % median, −4 MB RSS on every case

The compact-v1/v2 output is byte-identical to 0.6.0, artifact IDs included. Both reviews checked this on 200 fixture/profile/version combinations. The performance bench also checks byte identity between its arms. Exit codes are unchanged.

Fixes

• Diffs (v3). With Git's default three lines of context, a hunk header sits four lines above its first change. That is one line past the glue reach, so the header ranked last and was dropped. A hunk header now glues to the first change below it and ranks with it.
• git log -p (v3). Commit messages folded by template, so subjects that differ only by a number collapsed into one similar= line. That contradicts design.md. They now fold only with identical text.
• Codex coverage. git diff HEAD~1 and rg "\d+" src stayed native.
  • A ~ inside a word is literal, and so is a backslash before an ordinary character inside double quotes. Both now parse.
  • A tilde that would expand and \" or \\ are still rejected.
  • I checked the parsed words against sh, bash and zsh with default options. zsh's EXTENDED_GLOB would treat a mid-word ~ as a glob, the same caveat the subset already accepts for #.
• Codex coverage, more runners. npx -y/--yes <known tool> and yarn <known tool> (yarn jest, yarn tsc) are now recognized. Unknown tools, npx -p and yarn subcommands such as add stay native.
• Store growth. Paging or searching a blob whose view is all of it (typically one long line) stored that original again in a schema-1 artifact for every distinct recovery: 12 MB for two recoveries of a 6 MB JSON line. Such a result now names the blob (schema 2), but only when the blob is actually stored. The review found that a file read locally after a repository scan names a blob that was never kept, and a test covers that case.

Intended v3 output changes

Only the diff ranking changes. The other fixtures and stress inputs are identical in v3.

• git log -p, git profile.
  • 14 distinct commit subjects are shown instead of 2.
  • Changes, hunks and file headers are the same.
  • 35 index metadata lines no longer fit, so display_complete becomes false (omitted_units 0 → 35).
• git log -p, default 4 KB budget.
  • Distinct subjects (tier 2) now come before changes repeated across commits (tier 1), as design.md specifies.
  • 14 subjects instead of 2; 15 changes instead of 20; 10 hunks instead of 13.
• Unified diff, default profile.
  • Selection order shifts slightly: a +++ line that repeats the file named by diff --git and four index lines are no longer shown (omitted_units 8 → 13).
  • Changes and hunks are the same.
• Recovery artifact IDs. For a recovery whose only record is a whole stored blob, the artifact ID changes (schema 2). This is outside the compact-v1/v2 invariant.

Tested and left as is

• A code line such as src/lib.rs: pub enum Error { still ranks as a diagnostic in search output. Turning ranking off for the search profile fixes that line, but an rg over logs then shows 1 of 3 errors instead of 3.

Known limits, not addressed

• Large outputs. Over 250k lines (V3_MAX_LINES), output passes through unchanged. Raising that needs less memory per line first, starting with the full input copy in automatic_with.
• Recovery path. The view header still says scopelet expand. The absolute path is in the session guidance, not in every header.
• Native on purpose. FOO=1 cmd with a variable name off the allow-list stays native, and so does a pipeline that already ends in tail.

Verification

• cargo fmt --check and cargo clippy --all-targets --locked -- -D warnings.
• cargo test --locked: 178 tests.
• python3 scripts/check_skill.py.
• python3 -m unittest discover -s bench -p 'test_*.py'.
• bench/content.py: every fact is visible or recoverable.

Closes #12