Close bats coverage gaps, add hide_command helper, wire up kcov

- tests/helpers/common.bash: hide_command hides python3/jq/rg via a
  per-directory-batched PATH shim (not per-file — that took minutes),
  making the fail-open/grep-fallback branches testable.
- 20 new tests across all 7 .bats files: unknown flags, invalid
  --settings-scope, missing python3/jq, grep fallback when rg is
  unavailable, empty/multi-vault config edge cases, a vault path that
  stops existing or isn't a directory, and the previously-untested
  tool_name != Bash branch of force-ask-on-raw-git.sh. 53 -> 73 tests.
- hooks.bats: deploy the hooks once in setup_file() (BATS_FILE_TMPDIR)
  instead of per-test (BATS_TEST_TMPDIR) -- faster, and gives kcov one
  stable path per hook to aggregate coverage against instead of a
  fragmented copy per test.
- .gitignore (first in this repo) + tests/README.md Coverage section
  documenting the kcov invocation and why --include-pattern needs three
  entries, not two.

Real, tool-measured coverage via kcov: 86.15% (255/296 lines) across
all 10 wrapper/setup/hook scripts in both plugins, replacing an earlier
manual ~68% branch-coverage estimate.

tests/helpers/common.bash

@@ -87,6 +87,38 @@ with open(config_file, "w") as f:
 PYEOF
 }
 
+# hide_command <name> — makes <name> unresolvable for the rest of the test
+# by building a shim directory with symlinks to every executable currently
+# reachable via $PATH *except* <name>, then replacing $PATH with just that
+# directory. A plain "remove one directory from $PATH" doesn't work here:
+# python3/jq/rg all live in the same directory (/usr/bin) as git/sed/grep/
+# realpath/etc that the scripts under test also need, so excluding that one
+# directory would break everything, not just the target command. Callers
+# must do any setup that itself needs the now-hidden command (e.g. writing
+# a config file with write_git_manager_config/write_vault_config, both of
+# which shell out to python3) *before* calling hide_command.
+hide_command() {
+  local hidden="$1"
+  local shim="$BATS_TEST_TMPDIR/shim-no-$hidden"
+  mkdir -p "$shim"
+  local dir
+  local oldIFS="$IFS"
+  IFS=':'
+  local dirs=($PATH)
+  IFS="$oldIFS"
+  for dir in "${dirs[@]}"; do
+    [ -d "$dir" ] || continue
+    # One `ln` call per PATH directory (not per file) — forking `basename`
+    # and `ln` per file made this take minutes with a few thousand files
+    # spread across a dozen PATH dirs. `-n` skips a name already placed by
+    # an earlier (higher-priority) directory, matching normal PATH lookup
+    # order; unreadable dirs/empty globs are silenced.
+    ln -sn -t "$shim" "$dir"/* 2>/dev/null || true
+  done
+  rm -f "$shim/$hidden"
+  export PATH="$shim"
+}
+
 # json_get <file> <dotted.path> — small helper for assertions against JSON
 # written by setup.sh, without needing jq as a test dependency.
 json_get() {