fix(hooks): resolve cubic review issues

- Replace two-pass env interpolation with single-pass combined regex to
  prevent re-interpolation of $-sequences in substituted header values
- Convert HookEntry to discriminated union so type: "http" requires url,
  preventing invalid configs from passing type checking
- Add regression test for double-interpolation edge case

src/features/claude-code-plugin-loader/types.ts

@@ -80,16 +80,11 @@ export interface PluginManifest {
 /**
  * Hooks configuration
  */
-export interface HookEntry {
-  type: "command" | "prompt" | "agent" | "http"
-  command?: string
-  prompt?: string
-  agent?: string
-  url?: string
-  headers?: Record<string, string>
-  allowedEnvVars?: string[]
-  timeout?: number
-}
+export type HookEntry =
+  | { type: "command"; command?: string }
+  | { type: "prompt"; prompt?: string }
+  | { type: "agent"; agent?: string }
+  | { type: "http"; url: string; headers?: Record<string, string>; allowedEnvVars?: string[]; timeout?: number }
 
 export interface HookMatcher {
   matcher?: string