Close bats coverage gaps, add hide_command helper, wire up kcov

- tests/helpers/common.bash: hide_command hides python3/jq/rg via a
  per-directory-batched PATH shim (not per-file — that took minutes),
  making the fail-open/grep-fallback branches testable.
- 20 new tests across all 7 .bats files: unknown flags, invalid
  --settings-scope, missing python3/jq, grep fallback when rg is
  unavailable, empty/multi-vault config edge cases, a vault path that
  stops existing or isn't a directory, and the previously-untested
  tool_name != Bash branch of force-ask-on-raw-git.sh. 53 -> 73 tests.
- hooks.bats: deploy the hooks once in setup_file() (BATS_FILE_TMPDIR)
  instead of per-test (BATS_TEST_TMPDIR) -- faster, and gives kcov one
  stable path per hook to aggregate coverage against instead of a
  fragmented copy per test.
- .gitignore (first in this repo) + tests/README.md Coverage section
  documenting the kcov invocation and why --include-pattern needs three
  entries, not two.

Real, tool-measured coverage via kcov: 86.15% (255/296 lines) across
all 10 wrapper/setup/hook scripts in both plugins, replacing an earlier
manual ~68% branch-coverage estimate.

tests/obsidian-vault-kb/vault_search.bats

@@ -64,3 +64,16 @@ setup() {
   [ "$status" -eq 1 ]
   [[ "$output" == *"outside the vault"* ]]
 }
+
+@test "a subfolder that doesn't exist in the vault errors" {
+  run "$SCRIPT" pihole v NoSuchFolder
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"does not exist in the vault"* ]]
+}
+
+@test "grep fallback still finds matches when rg is unavailable" {
+  hide_command rg
+  run "$SCRIPT" pihole
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"dns-setup.md"* ]]
+}