test: cover resume tool pairing and plugin note fan-out

[cursor]

Risky behavior now covered

• Session resume closes a missing tool call in the middle of a batch, keeps the results around it (including an error result), and does not treat a stray tool id as that call.
• A later assistant turn with an open tool call is repaired after an earlier complete exchange, and a trailing unanswered user line is still dropped.
• before_llm_call keeps going after one plugin throws. An empty note and a non-string note are omitted. The surviving note is sent on that call only and is not written into history.
• Plugin settings arrays, and the objects inside them, are frozen copies. A plugin cannot push into the shared config.

Test files updated

• test/session_persist.test.ts
• test/plugin_host.test.ts

Why this reduces regression risk

Resume writes the transcript the next provider call will see. The existing tests covered a missing last call and a fully missing batch. They did not cover a hole in the middle, a stray id sitting in that batch, or a second assistant group followed by a dangling user. A bad index walk there sends the next turn an unpaired tool history.

Plugin notes are concatenated into one system message for a single model call. If a throwing hook stopped the fan-out, or an empty note was inserted, every later plugin's decision note would vanish or shift. Freezing only nested objects left arrays mutable, so a plugin could change settings shared with the next run.

No production code changed. Focused vitest (25) and tsc --noEmit passed. The full suite was not run; it still has known failures that spawn bun or need dist/.