fix: Prevent file descriptor leaks in hook subprocess calls

**Problem**: EIO error (errno -5) on fd 17 when hooks executed due to
improper file descriptor handling in subprocess invocations.

**Root Cause**: Subprocesses (uuidgen, date, mnemosyne, jq) were
inheriting file descriptors from parent process without proper stdin
protection, causing read attempts on invalid/closed fds.

**Solution**: Added stdin protection to all subprocess calls:
- Commands that don't read stdin: Added `< /dev/null` (uuidgen, date, mnemosyne recall)
- jq with `-n` flag: Added `< /dev/null` (doesn't read stdin)
- jq reading files: Changed from `jq ... "$FILE"` to `jq ... < "$FILE"` (explicit stdin)
- jq in pipes: No stdin redirect needed (pipe IS stdin)

**Changes**:
- .claude/hooks/session-start.sh: Protected uuidgen, mnemosyne recall, jq -n calls
- .claude/hooks/post-tool-use.sh: Protected uuidgen, date, jq file reads
- .claude/hooks/on-stop.sh: Changed jq file reads to use stdin redirect

**Testing**:
✅ All hooks execute cleanly in silent mode (CC_HOOK_DEBUG=0)
✅ Debug output works correctly (CC_HOOK_DEBUG=1)
✅ Memory debt tracking functions properly
✅ No fd errors or warnings

**Related**: Complements terminal corruption fixes (#eec1a33, #048f26d)

Author: rand

.claude/hooks/on-stop.sh

@@ -11,8 +11,8 @@ if [ ! -f "$STATE_FILE" ]; then
     exit 0
 fi
 
-DEBT=$(jq '.memory_debt' "$STATE_FILE" 2>/dev/null || echo "0")
-COUNT=$(jq '.memories_stored_count' "$STATE_FILE" 2>/dev/null || echo "0")
+DEBT=$(jq '.memory_debt' < "$STATE_FILE" 2>/dev/null || echo "0")
+COUNT=$(jq '.memories_stored_count' < "$STATE_FILE" 2>/dev/null || echo "0")
 
 # Only show reminder if there's an issue AND debug mode enabled
 if [ "${CC_HOOK_DEBUG:-0}" = "1" ]; then

.claude/hooks/post-tool-use.sh

@@ -11,12 +11,12 @@ STATE_FILE=".claude/memory-state.json"
 if [ ! -f "$STATE_FILE" ]; then
     cat > "$STATE_FILE" <<EOF
 {
-  "session_id": "$(uuidgen)",
+  "session_id": "$(uuidgen < /dev/null)",
   "memories_stored_count": 0,
   "last_memory_timestamp": null,
   "significant_events": [],
   "memory_debt": 0,
-  "session_start": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+  "session_start": "$(date -u +%Y-%m-%dT%H:%M:%SZ < /dev/null)",
   "last_recall": null
 }
 EOF
@@ -26,12 +26,12 @@ fi
 case "$TOOL_USE" in
   Edit|Write|Bash*commit*)
     # Increment memory debt
-    DEBT=$(jq '.memory_debt' "$STATE_FILE" 2>/dev/null || echo "0")
+    DEBT=$(jq '.memory_debt' < "$STATE_FILE" 2>/dev/null || echo "0")
     DEBT=$((DEBT + 1))
 
     # Update state
     TMP_FILE=$(mktemp)
-    jq ".memory_debt = $DEBT | .significant_events += [{\"type\": \"$TOOL_USE\", \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\", \"has_memory\": false}]" "$STATE_FILE" > "$TMP_FILE"
+    jq ".memory_debt = $DEBT | .significant_events += [{\"type\": \"$TOOL_USE\", \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ < /dev/null)\", \"has_memory\": false}]" < "$STATE_FILE" > "$TMP_FILE"
     mv "$TMP_FILE" "$STATE_FILE"
 
     # If debt >= 3, inject urgent prompt (only visible in debug mode)
@@ -54,7 +54,7 @@ Store memories about your recent work using:
 
 Recent unrecorded events:
 EOF
-        jq -r '.significant_events[] | select(.has_memory == false) | "  • \(.type) at \(.timestamp)"' "$STATE_FILE" | tail -5 >&2
+        jq -r '.significant_events[] | select(.has_memory == false) | "  • \(.type) at \(.timestamp)"' < "$STATE_FILE" | tail -5 >&2
 
         cat >&2 <<EOF
 

.claude/hooks/session-start.sh

@@ -18,7 +18,7 @@ PROJECT_NAME="$(basename "$PROJECT_DIR")"
 
 # Initialize memory state file
 STATE_FILE=".claude/memory-state.json"
-SESSION_ID=$(uuidgen)
+SESSION_ID=$(uuidgen < /dev/null)
 
 cat > "$STATE_FILE" <<EOF
 {
@@ -58,7 +58,7 @@ MEMORIES=$("$MNEMOSYNE_BIN" recall \
     --namespace "$NAMESPACE" \
     --limit 10 \
     --min-importance 7 \
-    --format json 2>/dev/null || echo '{"results": []}')
+    --format json < /dev/null 2>/dev/null || echo '{"results": []}')
 
 # Count memories
 MEMORY_COUNT=$(echo "$MEMORIES" | jq -r '.results | length' 2>/dev/null || echo "0")
@@ -101,7 +101,7 @@ $LINK_COUNT semantic connections across $MEMORY_COUNT memories
                 "additionalContext": $context
             },
             "suppressOutput": true
-        }'
+        }' < /dev/null
 else
     # Optional debug output (only if CC_HOOK_DEBUG=1)
     if [ "${CC_HOOK_DEBUG:-0}" = "1" ]; then
@@ -130,5 +130,5 @@ Memory enforcement is active. Store memories to avoid blocking later."
                 "additionalContext": $context
             },
             "suppressOutput": true
-        }'
+        }' < /dev/null
 fi