make coverage deterministic and add hook branch tests (fixes flaky main)

[pzverkov]

Summary

Fixes the coverage CI job two ways - unblocks main (the flaky daemon failure) and makes the coverage measurement deterministic - and adds sophisticated in-process branch tests for the action hooks.

What changed

Unblock main (tests/test_daemon.py)

• Under coverage, the daemon shut down slower than the tests' 2s terminate wait, so kill() ran but the Popen was never reaped, tripping a ResourceWarning in Popen.__del__ that filterwarnings=error escalated. All teardown now goes through a _stop_daemon helper that waits after kill.

Deterministic coverage (pyproject.toml, .github/workflows/ci.yml)

• The job measured the hooks and daemon via subprocess capture (COVERAGE_PROCESS_START + a .pth + combine), which was non-deterministic: two identical runs gave 60% and 67%, with daemon.py swinging 0-81%. A 65% gate on that is a latent flaky failure.
• Switched to in-process measurement (no subprocess machinery). daemon.py is omitted - it only runs as a spawned subprocess, so in-process coverage can't see it; it stays behavior-tested by tests/test_daemon.py. Dropping the subprocess instrumentation is also what removes the daemon-shutdown slowdown, so it is the primary fix for the red main.

Sophisticated branch tests (not happy-path)

• New hook_runner fixture (tests/conftest.py): reloads _common + the hook, feeds a stdin payload, calls main(), asserts the outcome.
• New tests/test_hook_post_tool_edit.py, tests/test_hook_pre_tool_bash.py, tests/test_hook_stop.py; extended tests/test_post_tool_bash.py. Each asserts behavior at a branch: gate warn/ask/block decisions, missing/non-zero exit code, verified vs unverified success claim, push/PR claim recording, transcript parsing.

Coverage

Now a stable 69% (deterministic across runs), gate raised 65 -> 67. Action hooks: hook_pre_tool_bash 93%, hook_post_tool_edit 89%, hook_stop 79%, hook_post_tool_bash 73% (were ~15-33%). The earlier 65% gate was measuring subprocess-capture noise; the new number is lower in spirit but real and stable.

The climb to the Silver test_statement_coverage80 target is tracked in #39 (roadmap updated).

No runtime behavior change, no version bump (tests + CI + docs only).