fix(plugins): stop stripLegacyHooks from deleting the plugin's own hooks

claude plugin install materializes the plugin's inline hooks into
~/.claude/settings.json itself, with \${CLAUDE_PLUGIN_ROOT} resolved to the
actual cache path — confirmed by installing the plugin for real and
inspecting the file. Those entries also contain "hook-handler.js", so
isOurEntry()'s plain substring match could not tell a legitimate
plugin-installed hook from a leftover npm run install-hooks entry: every
SessionStart would have stripped the plugin's own working hooks right back
out. isCheckoutHookEntry() only removes entries whose command does NOT
resolve under ~/.claude/plugins/cache/. plugin-doctor.js's duplicate-hook
count uses the same predicate.

docs/PLUGINS.md

@@ -91,10 +91,15 @@ checkout unnecessary.
 
 Because the plugin ships the hooks itself, `npm run install-hooks` is not needed
 for plugin users — and must not be run alongside it. Events carry no id, so two
-handlers mean every token and cost figure is counted twice. The bootstrap
-removes the older checkout-installed entries automatically (backing
-`~/.claude/settings.json` up as `settings.json.ccam-bak` first), and
-`/ccam-doctor` reports the state.
+handlers mean every token and cost figure is counted twice. `claude plugin
+install` writes the plugin's own hook entries into `~/.claude/settings.json`
+too (`${CLAUDE_PLUGIN_ROOT}` resolved to the actual cache path) — confirmed
+against a real install — so those entries also contain `hook-handler.js`, same
+as a leftover checkout install. The bootstrap tells them apart by whether the
+command resolves under `~/.claude/plugins/cache/`: only genuine checkout paths
+are removed (backing `~/.claude/settings.json` up as `settings.json.ccam-bak`
+first), never the plugin's own. `/ccam-doctor` reports the state using the same
+check.
 
 ### First session start