refactor(env): inject hook-handler env via capability traits

[akesling]

Summary

Routes the four hook entry points (handle_session_start, PreToolUse, PostToolUse, Stop) through a small Env struct that bundles three capability traits: PolicyStore, SessionRecorder, SandboxProbe. Production wires Env::prod() from zero-sized static impls that delegate to the existing free functions; tests construct a hermetic TestEnv whose session writes land in a TempDir and whose sandbox probe returns canned Full. The exact same handle_* code runs in tests as in production — only the env differs.

A repo-root clippy.toml denies direct calls to every wrapped function so the abstraction doesn't decay. clash/src/env.rs is the lone module exempt (top-level #![allow(clippy::disallowed_methods)]); CLI commands that legitimately bypass Env (e.g. clash doctor --sandbox) annotate their callsite with a per-site allow + rationale.

Commits

docs(plans): plan hook handler env injection
refactor(env): scaffold Env capability traits
refactor(env): implement SandboxProbe
refactor(env): implement PolicyStore
refactor(env): implement SessionRecorder
refactor(env): add hermetic TestEnv
refactor(handlers): inject Env into handle_session_start
refactor(cmd/hooks): route PreToolUse through Env
refactor(cmd/hooks): route PostToolUse through Env
chore(lint): deny direct calls to wrapped env functions
docs(env): note the clippy guardrail in module header

Test plan

• cargo test --package clash --lib — 392 tests passing
• cargo clippy --package clash --all-targets — zero disallowed_methods violations
• handlers::tests::test_session_start_reports_* — all three pass against the same handle_session_start production runs, via TestEnv, on a machine with a legacy ~/.clash/policy.json (previously panicked)
• TestEnv::new writes confined to a TempDir (asserted in env::tests::test_env_is_hermetic)

Out of scope (explicit non-goals)

• handle_permission_request migration — needs a Notifier trait for desktop + Zulip; no current test asks for it.
• Clock, Random, Stdio, HttpClient, Subprocess ports — no tests assert on these.
• Crate split (clash-core / clash-adapters / clash-bin) — the lint guardrail gives most of the same enforcement without the disruption.
• Effects-as-data on handlers — trait DI is enough for the current test surface.

Plan document

The implementation follows docs/superpowers/plans/2026-05-13-hook-handler-env-injection.md, which is committed in this PR as the first commit for traceability.