Fix review round 1 of the wait list and its hooks (issues 1629, 1743, 1744)

A session id reaching the Stop and SessionStart hooks was only checked
for blank, so "../../x" or "a/b" could read or write outside the waits
directory; both hooks now hold every session id to waitSessionID before
building any path, and allow (saying why) rather than fail on a bad one.
claude_code_wait's list/watched/done/said held only add to that same
check, letting a malformed id through as an ordinary, always-empty key;
they all refuse it now.

The Stop hook's three-strikes cap could be bypassed forever if its
counter file could not be written on a refusal: it now allows instead,
saying so, so a wait can never hold a turn open indefinitely. Its advice
offered mesh_wait on a wait's event family unconditionally, ignoring
that the session's tool runner may not be granted it (ADR 0367 §2); it
now offers mesh_wait only "if this session's tool runner is granted it,
otherwise start a watcher", and drops the family entirely when a wait
has none.

Both hooks' fail-open and let-through notices were said only on stderr,
which Claude Code does not show the operator on an allowed (exit 0)
outcome; they now also print the same words as a "systemMessage" JSON
object on stdout, which Claude Code does show.

modules/claude-code/cmd/claude-code/main.go

@@ -424,7 +424,7 @@ func main() {
 	// The plugin's Stop hook (novox/hq ADR 0489 §3-§6, issue 1743): keeps the turn open while a wait is unwatched
 	// or untold.
 	if len(os.Args) == 3 && os.Args[1] == "stop" {
-		os.Exit(runStop(os.Args[2], os.Stdin, os.Stderr))
+		os.Exit(runStop(os.Args[2], os.Stdin, os.Stdout, os.Stderr))
 	}
 	// The helper that touches the agent's home as the agent's account (novox/hq ADR 0266), started by this
 	// module through sudo: one answer per request on stdin, until it ends.