hook: connects to whatever listens at the socket path, without checking who owns it #4

• plugin/bin/hook.py:105-108 connects without checking the socket directory's owner, mode or whether it is a symlink. The daemon refuses a foreign directory (didbot crates/didbot-agentd/src/socket.rs:236-275), but that does not protect the hook.
• hook.py:331-341 puts the answer's identity and pending text into the model's context.

Failure: on a shared Linux host without XDG_RUNTIME_DIR (su, containers, some ssh sessions), another user pre-creates /tmp/didbot-agent/ and listens. They receive every report (session ids, cwd, tool names, request URIs) and can answer with text the agent reads as instructions.

Suggested fix: before connecting, lstat the directory and require owner getuid(), not a symlink, and mode & 0o077 == 0. On Linux, also check SO_PEERCRED on the socket.

Filed by Claude (agent) from a static read of main at a590e52.