feat(hooks): wire tool hooks into builtin pipeline, add HTTP hooks

[chaliy]

Summary

Completes the two main functional gaps from #1235 that PR #1253 deferred as follow-up:

• Wire before_tool/after_tool into execute_registered_builtin() — hooks can now modify args, cancel tool invocations, and observe results
• Add before_http/after_http — new HttpRequestEvent/HttpResponseEvent event types, interceptor hooks on HttpClient fired around every HTTP request (after allowlist check), builder API via BashBuilder::before_http()/after_http()
• Add "never close half-done issues" rule to process-issues and ship skills to prevent premature issue closure
• Update specs/009-implementation-status.md with hooks/interceptors section

What changed

File	Change
hooks.rs	Add HttpRequestEvent/HttpResponseEvent types; remove #[allow(dead_code)]
interpreter/mod.rs	Fire before_tool/after_tool in builtin execution; add fire_after_tool helper
lib.rs	Builder fields/methods for HTTP hooks; hook transfer during build; 6 new tests
network/client.rs	HTTP hook storage, setters, firing in request_with_headers and request_with_timeouts
Skills	"never close half-done issues" rule in process-issues and ship
Spec 009	Hooks/interceptors status table

Security

• before_http fires after the allowlist check — security boundary stays in bashkit
• Hooks are registered by the trusted embedder via BashBuilder (same trust model as HttpHandler)
• Cancellation messages don't leak internal state

What remains from #1235

Part of #1235 — the following items from the original issue are still open:

• Runtime registration API (bash.hooks().on_exit(...))
• Dedicated hooks spec in specs/
• Rustdoc guide in crates/bashkit/docs/
• examples/hooks.rs

Test plan

• test_before_tool_hook_modifies_args — hook rewrites args, output reflects change
• test_before_tool_hook_cancels — hook cancels echo, exit code 1
• test_after_tool_hook_observes_result — hook captures tool name, stdout, exit code
• test_before_tool_hook_does_not_fire_for_special_builtins — declare (special) skipped, echo (registered) fires
• test_before_http_hook_cancels_request — hook blocks curl to blocked.example.com
• test_after_http_hook_observes_response — hook wires correctly, builder accepts it
• 2413 lib tests pass, 123 doctests pass
• cargo fmt --check clean
• cargo clippy --all-targets --all-features -- -D warnings clean