fix(hooks): emit hookEventName on lite-mode SessionStart; make venv bootstrap self-sufficient

[andywu42]

Three small hook/bootstrap defects on dev, plus a gap in the OMN-9072 guard that let the first one through.

1. Lite-mode SessionStart silently drops its additionalContext

plugins/onex/hooks/scripts/session-start.sh:145 on dev:

echo '{"hookSpecificOutput":{"additionalContext":"omniclaude lite mode active — generic development tooling only"}}'

No hookEventName. The three full-mode SessionStart emissions in the same file (1533, 1542, 1546) all set it.

Impact, quoting this repo's own guard suite (tests/hooks/test_hook_event_names.py, OMN-9072):

The Claude Code client rejects payloads that lack hookEventName and silently drops any additionalContext, suppressOutput, or decision directives they carried.

This path is live — session-start.sh is wired via hooks-delegation.v1.json — so every lite-mode session loses that context. Line 145 is the only non-conforming hookSpecificOutput emission left under plugins/onex/hooks/scripts/.

2. ensure-plugin-venv.sh hard-fails when OMNI_HOME isn't exported

plugins/onex/hooks/scripts/ensure-plugin-venv.sh:19:

PROJECT_ROOT="${OMNI_HOME:?OMNI_HOME must be set}/omniclaude"

This script is invoked by hand, not as a hook: scripts/repair-plugin-venv.sh delegates to it, and the onboarding skill tells users to run it directly (plugins/onex/skills/onboarding/SKILL.md:98). A new user following onboarding is precisely who won't have OMNI_HOME exported yet — so today it aborts on their first run.

As a pre-venv bootstrap it never sources common.sh, so it can't pick up ~/.omnibase/.env the usual way. The fix mirrors common.sh's own set -a / source / set +a idiom (common.sh:391).

Incidental confirmation: this PR's own commit was initially blocked by the no-cloud-bus pre-commit hook, which failed with OMNI_HOME must be set — the same root cause, on a different script.

3. Stale header comment on ensure-plugin-venv.sh

The file's header claimed "Runs as a SessionStart hook." It isn't registered in hooks.json at all — that file carries only PreToolUse, PostToolUse, and SubagentStop. Corrected to describe the two real invocation paths. This comment is what made me misdiagnose #2 on first read.

4. Not fixed here — the OMN-9072 guard can't catch defect #1

scripts/check_hook_event_names.sh:

if ! grep -q 'hookEventName' "$file"; then

That's a whole-file test, not a per-emission one. session-start.sh contains hookEventName at 1533/1542/1546, so the file passes and line 145 stays invisible. Any file with at least one conforming emitter can hide unlimited non-conforming ones — exactly how this survived. (The hook passes on this branch, as expected.)

Arguably the more valuable fix; left out to keep this PR reviewable. Happy to take it in a follow-up.

Verification

• Full pre-commit suite passes at commit time, including check hook scripts include hookEventName in hookSpecificOutput, Arch: No hardcoded internal IPs, Block hardcoded internal IPs, Reject committed .env files, Env Var Registry (OMN-6263), and the .secrets.baseline guard.
• Both scripts pass bash -n; the edited line 145 is valid JSON.
• Rebased on current dev.

Note on the Receipt Gate

This PR carries no OMN ticket — I don't have Linear access, and the gate's only exemption is the dependency-bot allowlist, so it will fail.

To green it: add an OMN- token to the PR title (the gate reads the title, not the branch — no rename needed), plus an Evidence-Source: line and the matching OCC contract. Only you can produce those. Equally happy for you to close this and re-land it yourself, as with #795 → #797.

@coderabbitai ignore

[jonahgabriel]

Thanks for the thorough diagnosis and the pointer to the #795→#797 precedent -- taking that path. Re-landed under OMN-16416 as #2021 (diff unchanged, Co-authored-by trailer preserves your authorship). Closing this in favor of #2021.