fix(hint): re-fire bootstrap hint until all settings entries imported

[nnemirovsky]

Summary

• Replace the one-shot marker file gate (~/.claude/passthru.bootstrap-hint-shown) on the SessionStart bootstrap hint with a hash diff between importable entries in settings.json / settings.local.json and _source_hash values in passthru.imported.json.
• Embed _source_hash (sha256 of the whitespace-trimmed raw entry) on every rule that scripts/bootstrap.sh --write produces. Legacy imported files (no hashes) re-fire the hint until the user re-runs /passthru:bootstrap, which rewrites them.
• Extract is_importable_entry into hooks/common.sh as the single source of truth the converter and the hint helper share. Add normalize_settings_entry, hash_settings_entry, settings_importable_hashes, imported_hashes helpers.

Ships as v0.4.1.

Test plan

• bats tests/*.bats (521 tests, all passing)
• dedicated coverage for new common.sh helpers (29 new tests in common_helpers.bats)
• session-start hash-diff scenarios in session_start_hook.bats (22 tests, all new)
• bootstrap idempotence + _source_hash integrity in bootstrap.bats (4 new tests)
• live session smoke test via claude --plugin-dir . (deferred per auto-merge policy, user to verify post-release)