#1234 audit + output-guard SessionStart fix

Discovery during the M104 #1234 audit

My own #1817 work introduced src/hooks/bin/output-guard.mjs with an over-strict allow-list. It excluded SessionStart and PostCompact from EVENTS_WITH_ADDITIONAL_CONTEXT, even though CC actually consumes additionalContext on those events. Proof: hq-ext's session-start banner reaches the model via this exact path, and the banner is visible at session start of every CC session in those plugin trees.

Fix

Add SessionStart and PostCompact to both allow-lists. No structural change — just two more entries in two sets.

EVENTS_WITH_HOOK_EVENT_NAME += { SessionStart, PostCompact }
EVENTS_WITH_ADDITIONAL_CONTEXT += { SessionStart, PostCompact }

Why this matters for M104

The audit (commented on #1234) identified 5 cacheable hooks that should move from UserPromptSubmit → SessionStart to pin their context into the cached system prompt instead of re-injecting every turn. This guard fix is the prerequisite — without it, the dispatcher guard would silently strip the migrated hooks' output.

Tests

• Positive: SessionStart + PostCompact events preserve additionalContext + hookEventName
• SANITIZE_EVENTS table updated to remove SessionStart/PostCompact from the strip-list
• 43/44 tests pass (1 skipped — Notification, pre-existing)

Follow-ups (deferred to separate PRs)

• PR-A: Move ask-fallback-injector from UserPromptSubmit → SessionStart (smallest migration, no behavioral surprise)
• PR-B: agentation-context migration
• PR-C: unified-dispatcher handler-list audit (split cacheable handlers)
• PR-D: worktree-advisory-consumer flag-file optimization
• PR-E: Decide on antipattern-detector (legacy, rules already in .claude/rules/*.md)

Refs #1234.