fix(cli): prevent session hook from inheriting repository dotenv

[tachyon-beep]

Rebase of #143 (Codex) onto release/1.6.0, the working release branch; #143 targeted literal main and conflicted with the worktree analyze dotenv exclusion that landed in the meantime. Same single commit, conflict resolved by keeping both arms.

What

• should_load_dotenv now also excludes hook (session-start). The hook spawns a detached loomweave analyze when the index is stale, so loading a repository .env in the hook would hand repo-controlled values to that child in its inherited environment, bypassing the direct analyze exclusion (the child's own should_load_dotenv only prevents re-loading).
• Regression test session_start_hook_does_not_load_dotenv alongside the existing analyze / worktree-analyze / guidance cases.

Review notes

• The hook does not consume anything from .env: its only env handling is stripping GIT_* before spawning (hook.rs), so nothing is lost.
• cargo fmt --check, clippy -D warnings (loomweave-cli), nextest -p loomweave-cli (438 passed) locally.

Supersedes #143.

🤖 Generated with Claude Code

https://claude.ai/code/session_0183ccEmYnCh5Nx2Y6weYfHy

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Pull request overview

This PR updates the CLI startup dotenv-loading policy to ensure agent lifecycle hook commands do not load repository-controlled .env files, preventing those values from being inherited by detached subprocesses (notably background analyze) before the secret-scan gate runs.

Changes:

• Extend should_load_dotenv to exclude cli::Command::Hook { .. } in addition to existing exclusions.
• Update the rustdoc rationale to include hook commands as a third exclusion case.
• Add a regression test ensuring loomweave hook session-start does not load dotenv.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.