fix(hooks): harden every native harness contract

[TeoSlayer]

Summary

• repair current MCP/hook configuration paths and migrations for Claude, Cline, Continue, Copilot, OpenClaw, OpenHands, Junie, Hermes, PicoClaw, Codex, Cursor, and Gemini
• normalize real host payloads, retain post-failure evidence, require authoritative decisions, and enforce a fail-closed internal deadline
• pin and harden the OpenClaw native plugin for tool and outbound-message controls
• restore advertised doctor, tour, and identity lifecycle commands
• version-lock npm, runtime, registry, server card, generated configs, and plugin artifacts at 0.2.12

Validation

• npm test — 70/70
• npm run lint
• npm audit --audit-level=moderate — 0 vulnerabilities
• packed tarball install, MCP initialize, version, heartbeat compatibility
• packed unmanaged pass-through across all 10 native hook harnesses
• idempotent/migration contract tests for all 12 setup writers