Identity hook: three super-linear regexes bounded, so a long command cannot stall the guard (SonarCloud S8786) #239

Part of the epic "Epic: slice 0, foundations. The repo holds the line, its context is tested, and the platform facts are recorded".

Why. SonarCloud (python:S8786, three findings in tools/hooks/identity.py, reported by the org audit on 2026-10-20) says three of the identity hook's regular expressions have super-linear runtime. The hook is a mistake guard (decision 0040, 0041): it reads every command a session is about to run. A regex that backtracks super-linearly on a long or repetitive command could stall the hook, and so the session, for a command that is harmless. The hook already bounds arithmetic depth (command_unreadable); its regexes should be bounded the same way.

Done when

• Each of the three regexes is rewritten to linear form, or the input it reads is bounded in length before it is applied, with the refusal reason command_unreadable when the bound is exceeded; the hook's rows in decision 0040 say which.
• A boundary test with a long adversarial command shows the hook answers within the time the test sets, on main's form it does not.
• The regression script's corpus (10,722 commands, ~/.claude/sf-orchestration/h174/hook_regressions.py) shows 0 regressions from main and 0 new false refusals; a mutant per rewritten regex names its test.

Scope. Lane c (hooks). Hooks are helpers: this is a cost fix for the guard, not an enforcement claim.