hook-manager: add an overcommit adapter #1821

The hook-manager contract (#1819) defines how the secure agent setup integrates a git-hook manager: where its install puts the hook, how its home is split between sandboxed and host runs, and how the setup detects that a repository uses it.
prek is the only adapter so far.
This issue adds overcommit (Ruby).

What the source says (overcommit v0.73.0)

• Install target. It reads git config --get core.hooksPath (unscoped, so it sees the global value and any GIT_CONFIG_* override; git_config.rb:16-21, utils.rb:62-75) and falls back to --git-common-dir/hooks only when that is empty.
  It does not refuse: under the whole-user setup it installs into ~/.claude/git-hooks/, and preserve_old_hooks moves the dispatcher's symlinks into old-hooks/ (installer.rb:32-37, 131-145).
  That replaces the dispatcher for every repository on the host.
• Self-update on every run. Each hook run re-checks its installation through the same path (template-dir/hooks/overcommit-hook:66-70, installer.rb:50-58).
  From reading the code (not run): behind the dispatcher, compare_file looks for ~/.claude/git-hooks/overcommit-hook, gets ENOENT, and the generic rescue fails the hook.
• Fix. Run both the install and the chained hook with
  GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0="$(git rev-parse --path-format=absolute --git-common-dir)/hooks".
  Use the absolute path: git treats an empty core.hooksPath as set, so hooks would then resolve against /.
  (overcommit itself treats empty as "default", but other tools in the same process tree do not.)
• Trigger. overcommit --install; a ~/.claude/bin/overcommit shim catches it unless run through bundle exec.
• Home. None of its own.
• Generated hook. #!/usr/bin/env ruby; takes the hook type from File.basename($0), so it must be exec'd by its real path; reads .overcommit.yml from the working directory. Skip: OVERCOMMIT_DISABLE.
• Detection. .overcommit.yml at the root; hook marker overcommit.

What to do

1. Add a hooks-path-env install strategy to tools/agent-isolation/hook-manager-shim.sh and to STRATEGIES in tools/dev/sync-hook-managers.py.
   Note the subcommand is a flag (--install), not a word; the shim's install_subcommand handling may need to allow that.
2. Make the dispatcher export the same override when it chains into a hook whose repository uses overcommit (the registry needs a field for "needs the override at run time too").
3. Add the overcommit adapter to tools/hook-manager/registry.json, run tools/dev/sync-hook-managers.py, and add shim and dispatcher tests.
4. Verify the self-update behaviour by running it, and record the result in the contract.

Acceptance

• overcommit --install through the shim writes to the common dir and leaves ~/.claude/git-hooks/ untouched.
• A commit in an overcommit repository runs its hooks behind the dispatcher without the self-update failing.
• prek run --all-files --skip workspace-pytest and the affected tests pass.