fix(hook): recognize Grok's run_terminal_command tool name

[edouard-claude]

Closes #145.

The defect

snip hook grok classified only run_terminal_cmd and Bash as shell tools. The released Grok CLI sends run_terminal_command, which fell through to the passthrough path: empty stdout, exit 0, which Grok reads as allow. snip init --agent grok therefore installed a hook that filtered nothing, and snip gain only ever moved for manual snip run invocations.

Before:

$ printf '%s' '{"toolName":"run_terminal_command","toolInput":{"command":"git status"}}' | snip hook grok
 exit:0

After:

$ printf '%s' '{"toolName":"run_terminal_command","toolInput":{"command":"git status"}}' | snip hook grok
{"decision":"deny","reason":"snip can filter this command. Re-run as: \"/usr/local/bin/snip\" run -- git status"}
 exit:2

The fix

The three spellings live in one set: run_terminal_command (what the CLI sends), run_terminal_cmd (what the hook docs use) and Bash (the Claude-style alias). The init matcher gains the released name as well, so a fresh install matches it host-side too.

Not included: the issue's optional suggestion to audit unrecognized shell-like tool names under SNIP_HOOK_AUDIT=1. That is a separate feature, not this bug.

Tests

TestRunGrokShellToolNames runs the deny path across the three names. Dropping run_terminal_command from the set fails it; the two existing names keep their own coverage. make test-race and golangci-lint are clean.