Three operator-reported bugs from a fresh node bin/install.js install + pi boot:

1. pi-vibehack --version triggered the install flow because parseArgs puts --version into args.version (not args._) and the dispatch defaulted to install. Added an upfront --version/--help short-circuit.

2. v1.4.0 was tagged on git but not published to npm, so pi-mono's lazy reinstall (npm install -g @m4xx101/vibeshack@1.4.0) failed with ETARGET. 1.4.1 ships to @latest.

3. resources_discover returned the same prompts/ and skills/ paths that package.json#pi.prompts/pi.skills already declared. pi-mono logged '[Prompt conflicts] … (skipped)' on every boot. Now the hook returns only non-bundled extras: engagements/<id>/prompts and ~/.pi/agent/vibehack/prompts when they exist on disk. Tests rewritten accordingly. 337 → 340 tests.