Add technical documentation for hook interception system

[Copilot]

Documents how the plugin hook system intercepts and monitors Claude's actions during execution.

Changes

• New documentation: /docs/HOW_INTERCEPTION_WORKS.md

  • Hook system architecture and event-driven model
  • Six hook events (PreToolUse, PostToolUse, Stop, UserPromptSubmit, SessionStart, SessionEnd)
  • Data flow through stdin/stdout JSON protocol
  • Step-by-step interception traces with real code from hookify and security-guidance plugins
  • Custom hook creation guide

• README update: Added link to hook documentation in Plugins section

How Hooks Work

When Claude attempts a tool call, registered hooks receive event data via stdin, analyze it, and return a decision:

# Hook receives JSON via stdin
{
  "hook_event_name": "PreToolUse",
  "tool_name": "Bash",
  "tool_input": {"command": "rm -rf /tmp/test"}
}

# Hook returns decision via stdout
{
  "hookSpecificOutput": {"permissionDecision": "deny"},
  "systemMessage": "⚠️ Dangerous command blocked"
}

The documentation traces complete interception flows using hookify's pattern matching and security-guidance's vulnerability detection as concrete examples.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.