fix: clear full-main CodeQL findings

[cdeust]

Summary

• make the context-guard control flow explicit so full-branch CodeQL can prove input and threshold state are initialized
• replace silent best-effort persistence branches with explicit fallbacks or documented cache semantics
• use the existing state-directory seam in the subagent aggregate test instead of monkeypatching the process-wide os.path.join

Why this follows #16

PR #16 introduced CodeQL. Its pull-request analysis covered the changed lines and passed, while the first post-merge analysis of main surfaced eight pre-existing quality findings in shipped Python hooks. This follow-up addresses all eight CodeQL findings rather than treating the green PR check as proof that the complete default branch was clean.

Verification

• python -m pytest -q — 50 passed
• coverage run -m pytest -q && coverage report — 715 statements, 69 missed, 90%
• bash tests/statusline/test_heat_rgb.sh — 22 passed
• bash tests/statusline/test_fit_and_pace.sh — 53 passed
• python -m py_compile ... — passed for all three changed Python entry points
• git diff --check — passed

Closes the CodeQL findings currently numbered 11–18 once the default-branch analysis sees this revision.