fix: post-filter monk shell guard wrappers

[renaissancefieldlite]

Summary

• post-filter monk-agent hook block-monk allow/no-output results in the shell wrappers before allowing the command through
• block wrapper, nested-shell, command-substitution, absolute-path, and monkd daemon invocations for Claude-format and Antigravity-format hooks
• keep harmless data mentions such as grep monk README.md allowed
• mirror the shipped root hook changes into plugins/monk/hooks and extend regression coverage

Root Cause

The wrappers trusted the helper completely whenever it exited successfully. If the installed helper returned no deny decision for wrapper forms such as command monk deploy, bash -lc "monk deploy", absolute-path monk, or monkd, the wrapper exited successfully and the shell command was allowed.

Validation

• sh -n hooks/block-monk.sh
• sh -n plugins/monk/hooks/block-monk.sh
• sh -n .antigravity-plugin/hooks/block-monk.sh
• sh -n tests/block-monk-posix-postfilter.sh
• sh tests/block-monk-posix-postfilter.sh
• git diff --check

Not run locally: tests/block-monk-windows.ps1, because this machine does not have Windows PowerShell or pwsh installed.

Fixes #133.
Fixes #140.

[renaissancefieldlite]

Hi maintainers, quick bounty-status follow-up for accepted issues #133 and #140.

Both issues are now closed as accepted and fixed in v0.1.52. PR #167 contains the related public wrapper regression coverage, although it now conflicts after the upstream release.

Could you confirm whether scoring or rewards for #133 and #140 are recorded separately from this PR, and whether you need anything further from me? I will leave the conflicting PR unchanged unless you want it rebased or closed.