docs(#2665): the guard watches config.toml but GSD also writes <root>/hooks/ there

Found pre-push by this round's third adversarial review pass. Not a rebase
regression — round 3 shipped it and #2755 doubled it.

resolveExtraWatchTargets watches one config.toml per non-registry descriptor,
and its comment asserted "GSD writes ONE named file into these third-party
roots". That is false: bin/install.js also calls installSharedHooksBundle on the
same root, populating <root>/hooks/ with GSD's hook scripts and a CommonJS
marker. So a suite-produced leak of a hook bundle into a developer's real
~/.kimi or ~/.kimi-code passes this guard silently — #2665's own hazard, in
#2665's own safety net.

Behaviour is deliberately unchanged and the gap is disclosed instead. Closing it
is a layout decision rather than one more path, for the same reason
getGlobalSkillsBase is already a deliberate non-target: the snapshot applies the
config-root layout beneath every root it is given, and these roots are not ours.
Happy to fix it here or take it as a separate issue — the maintainer's call.

The enumeration-relative test could not have caught this: it asserts one target
PER DESCRIPTOR and nothing about whether one per descriptor is enough, because
its expectation is derived from the same array it checks. That is exactly the
scope boundary round-2 Nit 7 asked to be marked, biting one layer up from where
it was marked; the test now says so.

479979c4's message says "there are three" — that is three WATCHED targets, not a
count of write surfaces. The hooks bundle is a fourth, and unwatched.

lint:ci rc=0; tests/live-config-guard.test.cjs 24/24. Comments and catalog only.

tests/live-config-guard.test.cjs

@@ -210,6 +210,12 @@ describe('#2665: guard watches non-root write surfaces', () => {
       // named resolver instead would cover one of today's two entries and silently
       // miss tomorrow's — the same partial-enumeration defect that put
       // KIMI_SHARE_DIR outside the scrub set, one layer over.
+      //
+      // SCOPE BOUNDARY (per round-2 Nit 7, and it bites here): this asserts one
+      // target PER DESCRIPTOR and nothing about whether one target per descriptor
+      // is ENOUGH. It is not — <root>/hooks/ is also GSD-written and unwatched
+      // (named residual in resolveExtraWatchTargets). A test whose expectation is
+      // derived from the same array it checks cannot see that class.
       for (const d of NON_REGISTRY_CONFIG_HOME_DESCRIPTORS) {
         const dir = resolveConfigHomeFromDescriptor(d, { env, home });
         assert.ok(