fix(#3504): harden hook injection patterns and force-add guard (#3510)

* test(#3504): add failing-first parity, fail-closed, and bypass suites

* fix(#3504): harden hook injection patterns and force-add guard

* test(#3504): stage the scanner lib dependency in shared-hooks fixture

* chore(#3504): backfill changeset pr number

* test(#3504): build parity samples from fragments for the ci scan

---------

Co-authored-by: sim <sim@local>

tests/fixtures/install-tree/opencode.json

@@ -471,6 +471,7 @@
   "hooks/lib/cursor-workspace.js",
   "hooks/lib/git-cmd.js",
   "hooks/lib/gsd-graphify-rebuild.sh",
+  "hooks/lib/injection-patterns.js",
   "hooks/lib/isolation-sentinel.js",
   "hooks/managed-hooks-registry.cjs",
   "hooks/package.json",