test(miner-foundation): deny-hook fixture suite for house-rule primitives

[JSONbored]

Extend the deny-hook primitive from the sibling issue with a broader, table-driven fixture suite covering realistic tool-call shapes a future coding-agent driver will actually produce (file-write calls, shell-exec calls, git-command calls) rather than just the hand-rolled examples in that issue's own unit tests — this gives later phases confidence the rule matcher generalizes before any real driver is plugged in. Structured as its own issue (rather than folded into the primitive issue) to keep that issue's diff small and to let this fixture corpus be reviewed on its own merits as a safety-relevant test asset.

Deliverables

• test/fixtures/deny-hooks/ — a table of ~15-20 { toolCall, rules, expected: { allowed, blockedByReason? } } fixture cases spanning: workflow-file writes, .env reads/writes, secret-pattern path writes, force-push shell commands, and a good mix of CLEARLY-benign calls that must NOT be blocked (e.g. writing to src/signals/foo.ts, running npm test).
• A data-driven test (test/unit/deny-hooks-fixtures.test.ts) iterating the fixture table and asserting evaluateDenyHooks matches every expected entry exactly.
• At least 2 fixtures covering GLOB EDGE CASES (a path that superficially resembles a blocked pattern but isn't — e.g. src/environment.ts vs .env — and a path that IS blocked but via a less obvious glob match) to stress-test the matcher beyond the primitive issue's own basic tests.
• A short test/fixtures/deny-hooks/README.md documenting the fixture format so a later phase adding new default rules knows to add a matching fixture case here.

References

• packages/gittensory-miner/lib/deny-hooks.js (created by the sibling primitive issue — must land first) — the function under test.
• test/fixtures/local-scorer/ — existing fixture-directory convention in this repo (one concern's scenarios grouped under test/fixtures/<topic>/) to mirror for the new test/fixtures/deny-hooks/ directory.

[linear-code]

JSO-2393