fix(hooks): apply review fixes dropped by squash merge

The squash merge of PR #49 discarded two review fix commits. Re-applying:

- security-scan.sh: wrap output in hookSpecificOutput (PostToolUse protocol);
  restore secret/token detection; fix JSON newline escaping; escape file path
- validate-prompt.sh: try "user_prompt" field first, fall back to "prompt"
- log-bash.sh: document sed truncation limitation for quoted commands
- format-code.sh: fix misleading comment about updatedInput output

06-hooks/log-bash.sh

@@ -10,6 +10,9 @@
 INPUT=$(cat)
 
 # Extract the bash command from tool_input
+# Note: sed [^"]* stops at escaped quotes in JSON; for commands with double-quoted
+# strings, only the portion up to the first \" will be captured — this is a known
+# limitation of sed-based JSON parsing and is acceptable for logging purposes.
 COMMAND=$(echo "$INPUT" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
 
 if [ -z "$COMMAND" ]; then