Fail-safe global dedup: auto-clear stale repo-hooks-active markers

[Copilot]

--global dedup was treating any existing repo-hooks-active marker as valid, which could survive crashes/restarts and silently bypass all governance workflows. This change makes marker handling self-healing by aging out stale session markers before skip decisions.

• Global dedup hardening

  • Added stale-marker check in runWithRawInput(..., global=true) before repo hooks already active short-circuit.
  • If stale, marker is cleared and normal workflow processing continues instead of returning immediate allow.
  • Emits INFO log with session id, marker age, and threshold when stale cleanup occurs.

• Configurable staleness policy

  • Introduced HOOKFLOW_REPO_HOOKS_ACTIVE_STALE_THRESHOLD (default: 24h).
  • Invalid/non-positive values fall back to default with warning.

• Session sentinel support

  • Added IsRepoHooksActiveStale(threshold) to centralize marker age evaluation (exists + mtime + age).

• Coverage updates

  • Added sentinel-level tests for stale/non-existent marker behavior.
  • Added global-mode test ensuring stale marker is cleared and no longer keeps dedup in bypass mode.

• Docs

  • Updated README dedup section to document stale-marker auto-cleanup and threshold configuration.

Example (new behavior in global dedup path):

if repoActive {
    stale, age, _ := session.IsRepoHooksActiveStale(staleThreshold)
    if stale {
        log.Info("global mode: clearing stale repo-hooks-active marker for session %q (age=%s, threshold=%s)", raw.SessionID, age.Round(time.Second), staleThreshold)
        _ = session.ClearRepoHooksActive()
        repoActive = false
    }
}