fix(cli): prevent session hook from inheriting repository dotenv

[tachyon-beep]

Motivation

• The SessionStart hook can spawn a detached loomweave analyze while main() may already have loaded a repository .env, which lets repo-controlled loader/plugin environment variables reach the child and enable code-execution vectors.
• The goal is to stop repository .env values from being loaded for hook commands while preserving the background analyze behavior.

Description

• Update should_load_dotenv in crates/loomweave-cli/src/main.rs to also exclude cli::Command::Hook { .. } from loading repository .env and extend the doc comment to describe the rationale.
• Add a unit test session_start_hook_does_not_load_dotenv in crates/loomweave-cli/src/main.rs tests to prevent regressions for hook session-start.
• Preserve the hook's stale-index background analyze trigger; the change only prevents dotenv inheritance into the hook process environment.

Testing

• Ran cargo fmt --check, which completed successfully.
• Ran the focused regression test with cargo test -p loomweave-cli tests::session_start_hook_does_not_load_dotenv -- --exact, and the test passed (1 passed; 0 failed).
• Ran the package test suite for loomweave-cli during development; no test failures were observed.

---

Codex Task

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T16:21:12.385143Z	6302eb4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tachyon-beep]

Superseded by #149: same commit rebased onto release/1.6.0 (the working release branch) with the worktree analyze conflict resolved. Thanks — the finding was correct and is landing.