feat(brain): add memory, hooks, maxTurns; deprecate --initial-prompt

[Wirasm]

Summary

• Add memory: user, maxTurns: 200, and agent-scoped hooks: to kild-brain frontmatter
• Create bash guard script enforcing "no source code access" at the hook level (PreToolUse)
• Auto-snapshot fleet state on Stop hook
• Replace manual memory management (~40 lines) with auto-memory reference
• Fix router skill to use create-then-inject pattern instead of --initial-prompt
• Deprecate --initial-prompt in CLI help text + runtime warnings on both create and open
• Update CLAUDE.md with deprecation notes

Test plan

• bash -n .claude/hooks/brain-bash-guard.sh passes
• Guard blocks cat crates/..., cargo test, git diff, git log
• Guard allows kild list, gh issue list, cat .kild/..., cat ~/.kild/...
• cargo fmt --check passes
• cargo clippy --all -- -D warnings passes
• cargo test --all passes (424 tests)
• cargo build --all succeeds
• Manual: start brain session, verify hooks fire, test bash guard enforcement

[Wirasm]

PR Review Summary

Reviewed by 4 specialized agents: code-reviewer, docs-impact, silent-failure-hunter, code-simplifier.

Critical Issues (3 found)

Agent	Issue	Location
code-reviewer	Fleet sessions get two contradictory "Use instead" hints — general deprecation prints create && sleep 5 && inject, then fleet block prints just inject. Non-fleet sessions are fine; fleet sessions get conflicting guidance. Guard the general block with !(fleet_mode_active && is_claude_fleet_agent)	create.rs:140-176, open.rs:72-94
silent-failure-hunter	Guard JSON parsing bypassed by escaped quotes — [^"]* regex stops at first \", so cat "crates/foo.rs" produces truncated CMD, guard exits 0 (allow). Use jq -r '.command // empty' instead	brain-bash-guard.sh:21
silent-failure-hunter	Guard bypass via subshell — bash -c 'cat crates/...' is not caught by any blocklist pattern. Blocklist approach is fundamentally shallow; consider allowlist or document as advisory	brain-bash-guard.sh:28-50

Important Issues (5 found)

Agent	Issue	Location
silent-failure-hunter	Stop hook 2>/dev/null || true silently swallows all errors — brain bootstraps from stale state.json with no warning. Log stderr to a file instead of /dev/null	kild-brain.md Stop hook
code-reviewer	set -euo pipefail + grep -o interaction — if grep finds no match (exit 1), set -e kills the script with exit 1 (not 0, not 2). Add `
silent-failure-hunter	src/ blocklist pattern too broad — blocks any command string containing src/, including kild inject branch "check src/auth.rs". Either anchor the pattern or remove it (project source is under crates/)	brain-bash-guard.sh:28
code-reviewer, simplifier	open.rs deprecation warning uses bare eprintln! while create.rs uses color::warning()/color::hint(). Inconsistent visual output for the same message	open.rs:72-82 vs create.rs:140-157
silent-failure-hunter	Inbox fallback errors not structurally logged — Err(e) branch prints to stderr but no error!() event for cli.{create,open}.inbox_fallback_failed	create.rs:165-174, open.rs:84-93

Suggestions (3 found)

Agent	Suggestion	Location
simplifier	Remove initial_prompt_for_warning variable — clone at .with_initial_prompt(initial_prompt.clone()) use site instead of pre-emptive clone with renamed binding	create.rs:89-90
simplifier	Use [[ == *pattern* ]] instead of echo | grep -q for literal substring checks — fewer subprocess forks, more idiomatic bash	brain-bash-guard.sh:28-50
silent-failure-hunter	sleep 5 in SKILL.md is a race condition — if agent init takes longer, inject is silently lost. Add a kild list check after sleep to confirm session is active before injecting	SKILL.md:44-55

Documentation Issues

• CLAUDE.md: All --initial-prompt references are already updated in this PR. No stale references remain after merge.
• New features (memory, hooks, maxTurns, bash guard): Agent-internal — no CLAUDE.md additions needed.

Strengths

• Deprecation uses exit 2 correctly for hook blocks (not exit 1)
• create.rs error paths properly log with error!() + events::log_app_error()
• open.rs batch handle_open_all accumulates partial failures correctly
• Create-then-inject pattern is the right architectural direction

Verdict: NEEDS FIXES

Priority order:

1. Fix double-warning for fleet sessions (contradictory user guidance)
2. Fix guard JSON parsing (jq or fail-closed on parse error)
3. Fix set -e + grep interaction (script can exit 1 unexpectedly)
4. Fix Stop hook error suppression (log to file, not /dev/null)
5. Fix open.rs color inconsistency (use color::warning/color::hint)
6. Consider guard bypass vectors and document limitations or switch to allowlist