Close bats coverage gaps, add hide_command helper, wire up kcov

- tests/helpers/common.bash: hide_command hides python3/jq/rg via a
  per-directory-batched PATH shim (not per-file — that took minutes),
  making the fail-open/grep-fallback branches testable.
- 20 new tests across all 7 .bats files: unknown flags, invalid
  --settings-scope, missing python3/jq, grep fallback when rg is
  unavailable, empty/multi-vault config edge cases, a vault path that
  stops existing or isn't a directory, and the previously-untested
  tool_name != Bash branch of force-ask-on-raw-git.sh. 53 -> 73 tests.
- hooks.bats: deploy the hooks once in setup_file() (BATS_FILE_TMPDIR)
  instead of per-test (BATS_TEST_TMPDIR) -- faster, and gives kcov one
  stable path per hook to aggregate coverage against instead of a
  fragmented copy per test.
- .gitignore (first in this repo) + tests/README.md Coverage section
  documenting the kcov invocation and why --include-pattern needs three
  entries, not two.

Real, tool-measured coverage via kcov: 86.15% (255/296 lines) across
all 10 wrapper/setup/hook scripts in both plugins, replacing an earlier
manual ~68% branch-coverage estimate.

tests/git-manager/setup.bats

@@ -104,3 +104,22 @@ print(any('force-ask-on-raw-git.sh' in c for c in cmds))
   [ -f "$PROJECT_DIR/.claude/settings.json" ]
   [ ! -e "$HOME/.claude/settings.json" ]
 }
+
+@test "an unknown flag errors" {
+  run "$SETUP" --settings-scope user --bogus-flag
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"unknown argument '--bogus-flag'"* ]]
+}
+
+@test "an invalid --settings-scope value errors" {
+  run "$SETUP" --settings-scope nonsense
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"--settings-scope must be 'project' or 'user'"* ]]
+}
+
+@test "missing python3 fails with a clear error instead of a silent crash" {
+  hide_command python3
+  run "$SETUP" --settings-scope user
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"python3 is required"* ]]
+}