fix(hooks): repair 3 production hooks broken by a heredoc/stdin bug

`<pipe JSON> | python3 - <<'PY'` makes both `python3 -` and the heredoc claim
stdin; the heredoc wins, so the piped JSON is silently discarded — each hook
read empty input and never triggered. Fixed to `python3 -c "$(cat <<'PY')"`
(cat consumes the heredoc, python3's stdin stays free for the pipe), matching
the already-correct fable-stop-gate-hook.sh.

Impact, all verified before/after:
- user-prompt-hook.sh: the prompt-injection guard ALLOWED injection strings
  (exit 0); now correctly DENIES (exit 2). Security hole closed.
- post-tool-budget-hook.sh: every tool call hashed to {tool:unknown} — loop
  detection was blind; now hashes the real tool + args.
- usage-report-hook.sh: transcript path resolved empty so its curl sync never
  fired; now fires correctly.

2-line change per file; no logic/threshold/message/contract change. bash-guard
78/78 + fable-hooks 15/15 green; repo-wide grep confirms no remaining instances.

docker/scripts/post-tool-budget-hook.sh

@@ -25,7 +25,7 @@ input=$(cat 2>/dev/null || true)
 [[ -z "$input" ]] && exit 0
 
 # Strip MCP prefix, keep tool_input deterministic for hash.
-read -r TOOL ARGS_HASH <<<"$(printf '%s' "$input" | python3 - <<'PY'
+read -r TOOL ARGS_HASH <<<"$(printf '%s' "$input" | python3 -c "$(cat <<'PY'
 import json, sys, hashlib
 try:
     d = json.loads(sys.stdin.read())
@@ -37,7 +37,7 @@ try:
 except Exception:
     print("unknown unknown")
 PY
-)"
+)")"
 
 # Record the tool name on the SDK so the stop-hook can recognize a
 # graceful terminal call (i_am_idle / i_am_done / pass / fail / etc.).

docker/scripts/usage-report-hook.sh

@@ -16,7 +16,7 @@ SDK_URL="${ROBOCO_SDK_URL:-http://localhost:9000}"
 input=$(cat 2>/dev/null || true)
 [[ -z "$input" ]] && exit 0
 
-TRANSCRIPT=$(printf '%s' "$input" | python3 - <<'PY'
+TRANSCRIPT=$(printf '%s' "$input" | python3 -c "$(cat <<'PY'
 import json, sys
 try:
     d = json.loads(sys.stdin.read())
@@ -24,7 +24,7 @@ try:
 except Exception:
     print("")
 PY
-)
+)")
 
 [[ -z "$TRANSCRIPT" ]] && exit 0
 

docker/scripts/user-prompt-hook.sh

@@ -17,7 +17,7 @@ SDK_URL="${ROBOCO_SDK_URL:-http://localhost:9000}"
 input=$(cat 2>/dev/null || true)
 [[ -z "$input" ]] && exit 0
 
-prompt=$(printf '%s' "$input" | python3 - <<'PY'
+prompt=$(printf '%s' "$input" | python3 -c "$(cat <<'PY'
 import json, sys
 try:
     d = json.loads(sys.stdin.read())
@@ -25,7 +25,7 @@ try:
 except Exception:
     print("")
 PY
-)
+)")
 [[ -z "$prompt" ]] && exit 0
 
 low=$(printf '%s' "$prompt" | tr "[:upper:]" "[:lower:]")