Close bats coverage gaps, add hide_command helper, wire up kcov

- tests/helpers/common.bash: hide_command hides python3/jq/rg via a
  per-directory-batched PATH shim (not per-file — that took minutes),
  making the fail-open/grep-fallback branches testable.
- 20 new tests across all 7 .bats files: unknown flags, invalid
  --settings-scope, missing python3/jq, grep fallback when rg is
  unavailable, empty/multi-vault config edge cases, a vault path that
  stops existing or isn't a directory, and the previously-untested
  tool_name != Bash branch of force-ask-on-raw-git.sh. 53 -> 73 tests.
- hooks.bats: deploy the hooks once in setup_file() (BATS_FILE_TMPDIR)
  instead of per-test (BATS_TEST_TMPDIR) -- faster, and gives kcov one
  stable path per hook to aggregate coverage against instead of a
  fragmented copy per test.
- .gitignore (first in this repo) + tests/README.md Coverage section
  documenting the kcov invocation and why --include-pattern needs three
  entries, not two.

Real, tool-measured coverage via kcov: 86.15% (255/296 lines) across
all 10 wrapper/setup/hook scripts in both plugins, replacing an earlier
manual ~68% branch-coverage estimate.

tests/obsidian-vault-kb/vault_backlinks.bats

@@ -50,3 +50,10 @@ EOF
   [ "$status" -eq 0 ]
   [[ "$output" == *"no backlinks found"* ]]
 }
+
+@test "grep fallback still finds backlinks when rg is unavailable" {
+  hide_command rg
+  run "$SCRIPT" homelab-overview
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"dns-setup.md"* ]]
+}