Code review fixes: harden hook assets

- protect-paths.json: case-insensitive path match (Secrets.json, SECRET_KEY.txt
  now blocked) and broaden *secrets* -> *secret*
- notify-on-stop.json: strip quotes/backslashes from the notification message so
  osascript can't be broken by message content

CI/deploy/build review: 0 bugs (pipeline verified to pass on first run).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: bogdanmatasaru

assets/hooks/notify-on-stop.json

@@ -17,7 +17,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "msg=$(jq -r '.message // \"Claude Code needs your attention.\"'); osascript -e \"display notification \\\"$msg\\\" with title \\\"Claude Code\\\" sound name \\\"Glass\\\"\""
+            "command": "msg=$(jq -r '.message // \"Claude Code needs your attention.\"' | tr -d '\"\\\\'); osascript -e \"display notification \\\"$msg\\\" with title \\\"Claude Code\\\" sound name \\\"Glass\\\"\""
           }
         ]
       }

assets/hooks/protect-paths.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "f=$(jq -r '.tool_input.file_path // empty'); case \"$f\" in *.env|*.env.*|*/.env|*/.env.*|*secrets*|*/migrations/*|*.pem|*.key|*id_rsa*) echo \"Blocked: $f is a protected path. Edit it manually if you really mean to.\" >&2; exit 2 ;; esac; exit 0"
+            "command": "f=$(jq -r '.tool_input.file_path // empty'); lf=$(printf '%s' \"$f\" | tr 'A-Z' 'a-z'); case \"$lf\" in *.env|*.env.*|*/.env|*/.env.*|*secret*|*/migrations/*|*.pem|*.key|*id_rsa*) echo \"Blocked: $f is a protected path. Edit it manually if you really mean to.\" >&2; exit 2 ;; esac; exit 0"
           }
         ]
       }