Close bats coverage gaps, add hide_command helper, wire up kcov

- tests/helpers/common.bash: hide_command hides python3/jq/rg via a
  per-directory-batched PATH shim (not per-file — that took minutes),
  making the fail-open/grep-fallback branches testable.
- 20 new tests across all 7 .bats files: unknown flags, invalid
  --settings-scope, missing python3/jq, grep fallback when rg is
  unavailable, empty/multi-vault config edge cases, a vault path that
  stops existing or isn't a directory, and the previously-untested
  tool_name != Bash branch of force-ask-on-raw-git.sh. 53 -> 73 tests.
- hooks.bats: deploy the hooks once in setup_file() (BATS_FILE_TMPDIR)
  instead of per-test (BATS_TEST_TMPDIR) -- faster, and gives kcov one
  stable path per hook to aggregate coverage against instead of a
  fragmented copy per test.
- .gitignore (first in this repo) + tests/README.md Coverage section
  documenting the kcov invocation and why --include-pattern needs three
  entries, not two.

Real, tool-measured coverage via kcov: 86.15% (255/296 lines) across
all 10 wrapper/setup/hook scripts in both plugins, replacing an earlier
manual ~68% branch-coverage estimate.

tests/obsidian-vault-kb/vault_index.bats

@@ -45,3 +45,54 @@ setup() {
   [ "$status" -eq 1 ]
   [[ "$output" == *"no vault named"* ]]
 }
+
+# --- resolve_vault_path / canonicalize_and_check_dir edge cases ---
+# (exercised via vault_index.sh as a representative of the shared _lib.sh
+# logic used identically by vault_search.sh and vault_backlinks.sh)
+
+@test "no config file at all errors" {
+  rm -f "$CONFIG_FILE"
+  run "$SCRIPT"
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"no configuration found"* ]]
+}
+
+@test "an empty vaults array errors" {
+  write_vault_config "$CONFIG_FILE" "append"
+  run "$SCRIPT"
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"no vaults defined"* ]]
+}
+
+@test "multiple vaults registered without a name errors and lists names" {
+  VAULT2="$BATS_TEST_TMPDIR/vault2"
+  make_test_vault "$VAULT2"
+  write_vault_config "$CONFIG_FILE" "append" "v=$VAULT" "v2=$VAULT2"
+  run "$SCRIPT"
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"multiple vaults configured"* ]]
+  [[ "$output" == *"v2"* ]]
+}
+
+@test "a registered vault path that no longer exists errors" {
+  write_vault_config "$CONFIG_FILE" "append" "gone=$BATS_TEST_TMPDIR/does-not-exist"
+  run "$SCRIPT" gone
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"does not exist"* ]]
+}
+
+@test "a registered vault path that is a file, not a directory, errors" {
+  FILE_PATH="$BATS_TEST_TMPDIR/not-a-dir"
+  echo "just a file" > "$FILE_PATH"
+  write_vault_config "$CONFIG_FILE" "append" "plain=$FILE_PATH"
+  run "$SCRIPT" plain
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"is not a directory"* ]]
+}
+
+@test "missing python3 fails with a clear error instead of a silent crash" {
+  hide_command python3
+  run "$SCRIPT" v
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"python3 is required"* ]]
+}