fix: critical bugs, stale refs, README rewrite, security fixes

- Fix evaluator bypass on last story (moved completion check)
- Fix all stale command name references across README, loop.sh, skills, plugin.json
- Fix explore evaluator false rejects (.loop/ files are expected)
- Fix stderr capture order in headless mode
- Fix shell injection risk in hooks.sh python fallback
- Remove .DS_Store from tracking
- Rewrite README to match current architecture (single entry point, tmux, optional tools)
- Add XcodeBuildMCP and iOS simulator MCP to optional tools docs

lib/hooks.sh

@@ -20,9 +20,9 @@ install_hooks() {
         jq '.hooks.Stop = [{"matcher": "", "hooks": [{"type": "command", "command": "kill -INT $PPID || true"}]}]' \
             "$SETTINGS_FILE" > "${SETTINGS_FILE}.tmp" && mv "${SETTINGS_FILE}.tmp" "$SETTINGS_FILE"
     else
-        python3 -c "
+        LOOP_SETTINGS="$SETTINGS_FILE" python3 -c "
 import json, os
-p = '$SETTINGS_FILE'
+p = os.environ['LOOP_SETTINGS']
 s = json.load(open(p)) if os.path.exists(p) else {}
 s.setdefault('hooks', {})['Stop'] = [{'matcher': '', 'hooks': [{'type': 'command', 'command': 'kill -INT \$PPID || true'}]}]
 json.dump(s, open(p, 'w'), indent=2)
@@ -37,12 +37,13 @@ remove_hooks() {
             jq 'del(.hooks.Stop)' "$SETTINGS_FILE" > "${SETTINGS_FILE}.tmp" && mv "${SETTINGS_FILE}.tmp" "$SETTINGS_FILE"
             jq 'if .hooks == {} then del(.hooks) else . end' "$SETTINGS_FILE" > "${SETTINGS_FILE}.tmp" && mv "${SETTINGS_FILE}.tmp" "$SETTINGS_FILE"
         else
-            python3 -c "
-import json
-s = json.load(open('$SETTINGS_FILE'))
+            LOOP_SETTINGS="$SETTINGS_FILE" python3 -c "
+import json, os
+p = os.environ['LOOP_SETTINGS']
+s = json.load(open(p))
 s.get('hooks', {}).pop('Stop', None)
 if not s.get('hooks'): s.pop('hooks', None)
-json.dump(s, open('$SETTINGS_FILE', 'w'), indent=2)
+json.dump(s, open(p, 'w'), indent=2)
 "
         fi
         log "Stop hook removed"