fix: make plugin hooks run on Node 21+ and green the suite under modern Node (#2184)

ROOT CAUSE: hooks load plugin-hook-bootstrap.js via
`node -e "...; process.argv.splice(1,0,s); require(s)"`. On Node 21+,
require.main is `undefined` under --eval, so the `if (require.main === module)`
guard was false and main() never ran — every plugin hook silently no-op'd
(e.g. the MCP-health PreToolUse hook stopped blocking). CI (Node 18/20) hid
this; it only surfaces on Node 21+. Fix: also run main() when require.main is
undefined (the eval-bootstrap case), while staying dormant on real imports.

Also clears pre-existing main debt the full local suite enforces:
- catalog:sync — README/docs agent+skill counts drifted after recent merges
- tests/ci/supply-chain-watch-workflow: update checkout SHA to the merged v6.0.3 (#2183)
- markdownlint + check-unicode-safety --write across docs/skills

Suite: 2683/2683 green under Node v25; lint + unicode clean.

Co-authored-by: ECC Test <ecc@example.test>

scripts/hooks/plugin-hook-bootstrap.js

@@ -171,7 +171,14 @@ function main() {
   process.exit(Number.isInteger(result.status) ? result.status : 0);
 }
 
-if (require.main === module) {
+// Run when invoked as a hook entry. Production hooks load this via
+// `node -e "...; process.argv.splice(1,0,s); require(s)"`; on Node 21+ that
+// leaves require.main undefined (not this module), which previously skipped
+// main() and made every plugin hook a silent no-op. Guard on both the
+// direct-entry case and that eval-bootstrap case. When imported for its
+// exports (tests), require.main is a real, different module, so main() stays
+// dormant.
+if (require.main === module || require.main === undefined) {
   main();
 }