fix(plugins): chmod +x generated hook scripts in write_hook_plugin — closes ROADMAP #25 hotfix lane

Linux CI was failing 'hooks::tests::collects_and_runs_hooks_from_enabled_plugins'
with 'PostToolUse hook .../hooks/post.sh failed to start for "Read":
Broken pipe (os error 32)'. Three reproductions today on main:
24120271422, 24120538408, 24121392171 — escalated from first-attempt
flake to deterministic-red on the third push.

Root cause (per ROADMAP #25, recorded at 79da4b8): the test helper
write_hook_plugin in rust/crates/plugins/src/hooks.rs writes pre.sh,
post.sh, and failure.sh via fs::write with #!/bin/sh shebangs but
never sets the execute bit. On Linux, Command::new(path).spawn() on a
shebang script without +x can race in fork/exec — the pipe setup
succeeds, the post-fork exec fails, and the parent observes 'Broken
pipe (os error 32)' instead of a clean 'Permission denied'. macOS
fork/exec ordering happens to paper over it, which is why the test
passed locally and only flaked on Linux CI.

Surgical hotfix per gaebal-gajae's direction (message
1491325062031343787 in #clawcode-building-in-public): only the
chmod-+x in write_hook_plugin and a regression guard. No broader
harness cleanup. The deeper plugin-test sealing pass for ROADMAP #25
+ #27 stays in gaebal-gajae's OMX lane
omx-issue-149131850982-flaky-hooks-test.

Changes:
1. New helper make_executable(&Path) in the test module that sets
   mode 0o755 via std::os::unix::fs::PermissionsExt under #[cfg(unix)]
   and is a no-op on non-unix targets.
2. write_hook_plugin now binds each script's path to a local, calls
   fs::write on it, then calls make_executable on it before moving
   on. Three call sites: pre.sh, post.sh, failure.sh.
3. New regression guard test generated_hook_scripts_are_executable
   under #[cfg(unix)] that calls write_hook_plugin and asserts each
   of the three generated .sh files has at least one execute bit set
   (mode & 0o111 != 0). Future tweaks to write_hook_plugin cannot
   silently regress the chmod without breaking CI.

Verification:
- cargo test --release -p plugins hooks:: → 4 passing (3 existing
  hooks tests + new generated_hook_scripts_are_executable),
  including the previously-flaking
  collects_and_runs_hooks_from_enabled_plugins
- cargo test --release -p plugins → 35 passing, 0 failing
- cargo fmt -p plugins → clean
- cargo clippy -p plugins -- -D warnings → clean

Co-authored-by: gaebal-gajae <gaebal-gajae@layofflabs.com>

Author: code-yeongyu

rust/crates/plugins/src/hooks.rs

@@ -359,6 +359,18 @@ mod tests {
         std::env::temp_dir().join(format!("plugins-hook-runner-{label}-{nanos}"))
     }
 
+    fn make_executable(path: &Path) {
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let perms = fs::Permissions::from_mode(0o755);
+            fs::set_permissions(path, perms)
+                .unwrap_or_else(|e| panic!("chmod +x {}: {e}", path.display()));
+        }
+        #[cfg(not(unix))]
+        let _ = path;
+    }
+
     fn write_hook_plugin(
         root: &Path,
         name: &str,
@@ -368,21 +380,30 @@ mod tests {
     ) {
         fs::create_dir_all(root.join(".claude-plugin")).expect("manifest dir");
         fs::create_dir_all(root.join("hooks")).expect("hooks dir");
+
+        let pre_path = root.join("hooks").join("pre.sh");
         fs::write(
-            root.join("hooks").join("pre.sh"),
+            &pre_path,
             format!("#!/bin/sh\nprintf '%s\\n' '{pre_message}'\n"),
         )
         .expect("write pre hook");
+        make_executable(&pre_path);
+
+        let post_path = root.join("hooks").join("post.sh");
         fs::write(
-            root.join("hooks").join("post.sh"),
+            &post_path,
             format!("#!/bin/sh\nprintf '%s\\n' '{post_message}'\n"),
         )
         .expect("write post hook");
+        make_executable(&post_path);
+
+        let failure_path = root.join("hooks").join("failure.sh");
         fs::write(
-            root.join("hooks").join("failure.sh"),
+            &failure_path,
             format!("#!/bin/sh\nprintf '%s\\n' '{failure_message}'\n"),
         )
         .expect("write failure hook");
+        make_executable(&failure_path);
         fs::write(
             root.join(".claude-plugin").join("plugin.json"),
             format!(
@@ -496,4 +517,27 @@ mod tests {
             .iter()
             .any(|message| message == "later plugin hook"));
     }
+
+    #[test]
+    #[cfg(unix)]
+    fn generated_hook_scripts_are_executable() {
+        use std::os::unix::fs::PermissionsExt;
+
+        // given
+        let root = temp_dir("exec-guard");
+        write_hook_plugin(&root, "exec-check", "pre", "post", "fail");
+
+        // then
+        for script in ["pre.sh", "post.sh", "failure.sh"] {
+            let path = root.join("hooks").join(script);
+            let mode = fs::metadata(&path)
+                .unwrap_or_else(|e| panic!("{script} metadata: {e}"))
+                .permissions()
+                .mode();
+            assert!(
+                mode & 0o111 != 0,
+                "{script} must have at least one execute bit set, got mode {mode:#o}"
+            );
+        }
+    }
 }