chore(go): audit shared plugin helpers

Drop unused expandHome and standardizeJSONC, share the runtime base URL
validator between the guard and audit templates, and trim comments.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

cmd/elydora/plugins/hooktemplate.go

@@ -13,10 +13,7 @@ func buildHookScriptWithOutput(
 	return fmt.Sprintf(`#!/usr/bin/env node
 'use strict';
 
-// ---------------------------------------------------------------------------
-// Self-contained Elydora audit hook for: %s
-// Generated by @elydora/sdk — DO NOT EDIT
-// ---------------------------------------------------------------------------
+// Elydora audit hook for %s. Generated by Elydora SDK.
 
 const crypto = require('node:crypto');
 const fs = require('node:fs');
@@ -53,10 +50,6 @@ function parsePrivateKey(raw) {
   return value;
 }
 
-// ---------------------------------------------------------------------------
-// Embedded crypto (from @elydora/sdk src/crypto.ts + src/utils.ts)
-// ---------------------------------------------------------------------------
-
 function base64urlEncode(data) {
   const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
   return buf.toString('base64url');
@@ -158,10 +151,6 @@ function generateNonce() {
   return base64urlEncode(crypto.randomBytes(16));
 }
 
-// ---------------------------------------------------------------------------
-// Chain state persistence (atomic writes)
-// ---------------------------------------------------------------------------
-
 function readChainState() {
   let raw;
   try {
@@ -265,10 +254,6 @@ function advanceChainState(fromHash, toHash) {
   });
 }
 
-// ---------------------------------------------------------------------------
-// Error logging
-// ---------------------------------------------------------------------------
-
 function logError(err) {
   try {
     const ts = new Date().toISOString();
@@ -281,32 +266,6 @@ function logError(err) {
   }
 }
 
-function resolveAuditBaseURL(config) {
-  const value = config.base_url || 'https://api.elydora.com';
-  if (typeof value !== 'string' || /[\\\u0000-\u0020]/.test(value)) {
-    throw new Error('Agent config base_url must be an absolute HTTP or HTTPS URL');
-  }
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch (error) {
-    throw new Error('Agent config base_url must be an absolute HTTP or HTTPS URL');
-  }
-  if (!['http:', 'https:'].includes(parsed.protocol) || !parsed.hostname) {
-    throw new Error('Agent config base_url must be an absolute HTTP or HTTPS URL');
-  }
-  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
-    throw new Error(
-      'Agent config base_url must exclude credentials, query parameters, and fragments',
-    );
-  }
-  return value.replace(/\/+$/, '');
-}
-
-// ---------------------------------------------------------------------------
-// Main hook logic
-// ---------------------------------------------------------------------------
-
 async function postOperation(baseUrl, token, eor, deadline) {
   const remaining = deadline - performance.now();
   if (remaining <= 0) throw new Error('Audit API retry budget exhausted');
@@ -344,7 +303,6 @@ async function postOperation(baseUrl, token, eor, deadline) {
 
 async function main() {
   try {
-    // Read JSON from stdin
     const chunks = [];
     for await (const chunk of process.stdin) {
       chunks.push(chunk);
@@ -380,7 +338,6 @@ async function main() {
       hookData.conversation_id || hookData.session_id || hookData.sessionId ||
       hookData.session || hookData.taskId || 'unknown';
 
-    // Read agent config and private key
     let config;
     let privateKey;
     try {
@@ -408,7 +365,7 @@ async function main() {
     const orgId = config.org_id;
     const agentId = config.agent_id;
     const kid = config.kid;
-    const baseUrl = resolveAuditBaseURL(config);
+    const baseUrl = resolveConfigBaseURL(config);
     const token = config.token || '';
     if (typeof orgId !== 'string' || !orgId || typeof agentId !== 'string' ||
         !agentId || typeof kid !== 'string' || !kid) {
@@ -416,7 +373,7 @@ async function main() {
     }
     if (typeof token !== 'string') throw new Error('Agent config token must be a string');
 
-    // Build and submit, retrying from the server chain head on PREV_HASH_MISMATCH
+    // Retry from the server chain head on PREV_HASH_MISMATCH.
     const payload = NATIVE_PAYLOAD ? hookData : {
       tool_name: toolName,
       tool_input: toolInput,