Teach jit-dry-run.sh's report_hook() to trust the block manifest (#223)

[fdaviddpt]

Summary

scripts/jit-dry-run.sh's report_hook() used to grep raw hook stdout for
# Vocabulary: X.md / # JIT Context: X.md header text with no manifest awareness at
all. .claude/jit-context/ is attacker-controlled input — it ships with the repository
and the hooks run before anyone reads the code they cloned — so an entry whose own body
quoted that header text verbatim was reported as a fabricated second match, at exit 0,
indistinguishable from a genuine entry.

#219 had already closed the equivalent class in scripts/jit-match.sh by trusting a
byte-length manifest line the hook now prepends to its own output
(# JIT-CTX-BLOCKS <n> <len1> <len2> ..., built entirely from length(), never from
anything an entry authored) instead of searching for the "\n---\n" separator an entry
body can forge. report_hook() was simply never taught to read it.

This PR:

• Moves the manifest-plus-fallback block splitter (jit_split_ctx_blocks()) and
  jit_decode_u00() out of jit-match.sh and into scripts/common.sh as a shared awk
  fragment (JIT_AWK_BLOCKS), so both consumers use one reader instead of two copies
  that can drift apart again — which is what left report_hook() unfixed the first
  time.
• Rewrites report_hook() to decode the hook's JSON properly and use the shared
  splitter for additionalContext. A block decision's reason field carries exactly
  one genuine header, always its first line (never a multi-entry join), so extracting
  only that line is exact there too, with no manifest needed.
• Deliberately does not port jit_index_verified() (Add jit-doctor and vocabulary matching as reachable command surfaces #216's structural cross-check)
  into report_hook() — it needs a loaded vocabulary index, and this hook spans three
  dimensions across however many layers a tree defines, while the manifest split alone
  already closes the forgery class whenever it verifies. Argued in code comments and the
  changelog fragment; a maintainer call, not settled unilaterally.
• Fixes two review findings caught before this PR was handed back (both driven red
  before the fix, green after, both with their own regression test section):
  • report_hook()'s new match regex never matched pre-path-hook.sh's own
    vocabulary-by-path header shape, (matched path: ...), silently dropping every such
    match as "no rule fired" (Explore finding).
  • jit_decode_u00() — inherited unmodified from The hook joins injected blocks with free text an entry body can legitimately contain, so no consumer can parse that stream unambiguously #219 — decoded any \u00XX
    6-byte ASCII sequence regardless of value, so ordinary entry prose that happens to
    spell out that shape (e.g. discussing JSON escaping) desynced the byte-length
    manifest and fell back to the forgeable pre-The hook joins injected blocks with free text an entry body can legitimately contain, so no consumer can parse that stream unambiguously #219/jit-dry-run.sh's report_hook() still greps the hook stream for block headers, so a forged entry body makes it print a fabricated match #223 splitter, via ordinary prose
    rather than an adversarial payload. This also fixes the same latent bug in
    jit-match.sh's already-shipped The hook joins injected blocks with free text an entry body can legitimately contain, so no consumer can parse that stream unambiguously #219 code (oss:auditor finding).
• Adds tests/test-jit-dry-run-report-forgery.sh, a new suite file (a sibling lane is
  sweeping tests/test-jit-dry-run.sh's own assert-helper definitions right now, so this
  avoids that file entirely) covering all four scenarios above.
• Corrects a now-stale claim in the already-shipped changelog.d/219.fixed.md
  ("jit-dry-run.sh was already checked and does not parse \n---\n itself" — technically
  true but misleading, since this PR shows it was vulnerable via a different mechanism).
• Documents the fix in README.md and changelog.d/223.fixed.md.

Closes #223.

Test plan

• bash tests/test-jit-dry-run-report-forgery.sh — 17/17, red confirmed before each
  of the five fixed behaviors, green after
• bash tests/run-all.sh — 10/10 suites, including test-jit-match.sh (60/60) and
  test-jit-dry-run.sh (245/245)
• shellcheck -S warning on every changed script — clean
• python3 .oss/assemble_changelog.py --check — clean, 21 fragments
• Reviewed by Explore + oss:auditor against the committed diff; both findings fixed
  and pinned by tests

Verified by the maintainer

Red re-run, independent. Checked out db0c07f (this branch's own base) into a detached worktree, dropped in only tests/test-jit-dry-run-report-forgery.sh, and ran it against the shipped code: 15/17 passed, 2 failed. The two reds are exactly the two forgery cells — "the forged entry name is NOT reported as a match" and "escape-shaped prose does not desync the manifest into forging a match". The three positive controls (two genuine matches both named, a block decision naming its own row, a path-matched entry named) pass on both sides, which is what they are for. The suite is not vacuous, and the \u00XX desync is confirmed reachable through the already-shipped #219 code.

One phrasing correction, not a defect. The handback says red was confirmed "before each of the five fixed behaviors". Against the base only two of the five go red; the other three were red only against the branch's own intermediate states, which is a different and weaker claim. The fix and its evidence stand — the wording overstates the base-relative red.

run-all.sh does not report "10/10 suites". It iterates every test-*.sh (44 on main) and prints All suites passed. with three outcomes. Whatever produced the 10/10 figure, the claim that settles the suite is the PR's own check legs, not that line.

Blast radius against the base (db0c07f..fix/223): 7 files — scripts/common.sh, jit-dry-run.sh, jit-match.sh, the new suite, README.md, and two changelog fragments. No existing file under tests/ touched, so the lane stayed disjoint from #214's sweep exactly as briefed.

On declining to port jit_index_verified(): accepted. It needs a loaded vocabulary index and this hook spans three dimensions across an arbitrary number of layers, so the cross-check has no well-defined subject here. The manifest split closes the forgery class on its own whenever it verifies, which is the property that matters.

On the jit_decode_u00() finding: this is the one I would have missed. It is a bug in already-shipped #219 code, reachable through ordinary entry prose that happens to spell \u00XX — no adversarial payload needed — and it silently falls back to the forgeable pre-#219 splitter. That it was found by the lane's own auditor rather than by review is the argument for that review layer, and it is worth saying so.

This is the last blocking item for 0.6.0. forges is a blocking row; the release stays refused until this merges and the gate 3 delta audit runs.