fix(hooks): load SKILL.md from plugin layout

[chrisvaillancourt]

Summary

• Load skills/caveman/SKILL.md from the current plugin src/hooks layout before falling back to the legacy flat hook layout.
• Gate the two-level plugin probe to real src/hooks installs so standalone hooks under $CLAUDE_CONFIG_DIR/hooks cannot accidentally read unrelated ~/skills content.
• Add regression tests that verify plugin layout loads the real skill file, cwd-local skills are ignored, and standalone layout still falls back when only home-level skills exist.

Root Cause

The Claude Code plugin manifest runs ${CLAUDE_PLUGIN_ROOT}/src/hooks/caveman-activate.js, so __dirname is <plugin_root>/src/hooks. The hook still looked for ../skills/caveman/SKILL.md, which resolves to <plugin_root>/src/skills/caveman/SKILL.md. That file does not exist, so the hook silently served the hardcoded fallback instead of the source-of-truth skill body.

That fallback is missing the intensity table and wenyan instructions, so plugin installs did not get the full behavior documented in skills/caveman/SKILL.md.

Validation

• uv run python -m unittest tests.test_hooks
• node src/hooks/caveman-activate.js | rg '## Intensity|Current level:'
• git diff --check
• uv run python -m unittest tests.test_compress_safety
• node tests/test_symlink_flag.js

Additional documented checks were run and failed for existing baseline issues unrelated to this change:

• npm test fails in OpenCode installer tests (caveman-compress.md missing / temp OpenCode files absent / JSONC parse expectation). This same failure was observed on clean upstream main before this branch.
• node tests/test_caveman_init.js fails count-based assertions around current init targets/OpenClaw handling. This same failure was observed on clean upstream main.

Review Notes

Additional review found two hardening gaps in the first draft: the ungated ../../skills probe could escape standalone hook installs into ~/skills, and the plugin-layout test used cwd=plugin_root. This version gates the plugin probe to src/hooks, runs the regression from an unrelated cwd with a sentinel cwd skill, and adds a standalone-home sentinel test.

Overlap

Several open PRs touch src/hooks/caveman-activate.js, including #483, #448, #411, #407, #401, and #377. This PR keeps the scope to the SKILL.md path lookup and its regression test so it can be rebased independently. Older dirty PRs such as #285 and #269 touch the pre-src hook path and may need the same path logic if revived.

Fixes #467