fix(doctor): detect new Claude Code hook exec-form schema

[kengio]

Summary

/doctor was false-flagging both required hooks as missing on vaults whose register-hooks had already migrated entries to the canonical exec-form schema ({command: "onebrain", args: ["checkpoint", "stop"]}). The substring check only inspected the command field, which under the new schema is just "onebrain" — the verb lives in args[].

This PR teaches the validator to compute an effective command string by joining command + args[] before substring matching, so both legacy and exec form resolve to "onebrain checkpoint stop". It also adds form classification so legacy entries are surfaced (not hidden) and the existing --fix migration path can take over.

Changes

• validator.ts: new effectiveCommand() + detectHookForm() helpers; required-hook check now distinguishes exec / legacy / absent
• Stale-hook sweep uses the same joined string — catches onebrain references buried in args[]
• --fix path unchanged: runRegisterHooks already migrates legacy → exec via its rewriteIfShellForm pass
• 6 new unit tests in src/lib/index.test.ts covering exec, legacy, bash-wrapper, absent, mixed-group, and qmd-skip
• doctor/SKILL.md description updated to match new behavior
• CLI 2.3.1 → 2.3.2 · plugin 2.4.10 → 2.4.11

Test plan

• bun run typecheck clean
• bun test src/lib/index.test.ts — 27/27 pass (6 new + 21 existing)
• bun test src/commands/internal/register-hooks.test.ts — 40/40 pass
• Full suite delta vs main: same 13 pre-existing TTY-timeout flakes, +6 pass from new tests
• Manually confirmed user's current vault (canonical exec form) now passes hook check