* test(#3662): failing-first suite for runtime-resolving hook runners
* fix(#3662): resolve managed hook node runners at hook-fire time
* fix(#3662): close review findings and document the resolver
* fix(#3662): close adversarial and security review findings
* chore(#3662): backfill changeset pr number
* test(#3662): honor win32 skip return and platform-aware sh runner pin
* test(#3662): pin the bare win32-claude sh-hook shape omitting the bash runner
---------
Co-authored-by: sim <sim@local>