feat(hooks): index skill usage by project and session

[chipfighter]

Why

The usage log exists to show where skills fire, and on Windows it could not.
Skill records took cwd from the hook payload without undoing its JSON escaping,
so C:\Users was logged as C://Users. Session records took Git Bash's $PWD,
which reads /c/Users, or /tmp/... under a mount. The same project sat under
two spellings, skills-count.sh had no per-project view, and nothing tied a skill
record back to the conversation that produced it.

Checked against a real log (2,474 records since 2026-07): every Windows project
was split this way, and 73 of the 182 skill records came from one
claude plugin eval scratch directory, which stayed invisible until usage is
broken down by project.

What changed

• fix(hooks): the shared writer canonicalizes every path. Windows paths
  become C:/x; MSYS paths go through cygpath, the only thing that knows where
  a mount such as /tmp points. POSIX hosts are unchanged.
• feat(hooks): skill records carry the host's session_id, appended last so
  existing readers keep working. skills-count.sh breaks skill invocations down
  by project and folds records written before the fix onto the current spelling,
  so an existing log stays comparable with new records.
• docs: both READMEs describe the per-project summary and the session id.
• fix(hooks), found in review: decoding the payload left real backslashes in
  skill and session_id, and the writer escaped only quotes, so odd\name
  was logged as a newline and a trailing backslash broke the record. The writer
  now escapes backslashes before quotes.
• chore(release): both manifests bumped to 0.10.0.

No skill text, primer, or fixed-context change. The sink is still
~/.coding-discipline/usage.jsonl.

Version

Ships as v0.10.0. v0.9.0 was tagged and released from main (f45a6a2) first,
so its frozen scope stays intact; this branch is a minor bump because
per-project usage and session ids are a new capability.

Verification

Written test-first. Each new case failed on the old code for the real reason
before passing: the payload case logged "cwd":"C://Users//dev//proj", on
Windows one directory came out as /tmp/.../repo and C://Users//...//repo,
and the review case produced a record that json.loads rejects.

Review probes beyond the suites: a directory named with Chinese characters and a
space, run both through Git Bash directly and through cmd.exe and
run-hook.cmd, produced one spelling and valid UTF-8 for session and skill
records alike.

All four suites pass locally on 35e39d9: plugin metadata, the safety scan, the
hook suite under Git Bash, and the Windows suite, which drives log-usage
through run-hook.cmd the way Claude Code does on Windows. Run read-only against
the real log, the new section prints one line per project with pre-fix and
post-fix records merged.

Notes:

• Existing session records keep their /d/... spelling. The report only folds
  skill records, because the per-project view counts skill invocations.
• On Windows, SessionStart now spends one extra cygpath process. Acceptable
  for a once-per-session hook; noted in case startup time ever matters.

🤖 Generated with Claude Code