feat(go): durable transaction engine and Kiro IDE 1.0 adapter

Split the monolithic transaction into focused modules: append-only
crash-recoverable journal under ~/.elydora/transactions with owner
tokens and per-transaction namespaces, staged atomic publication
(stage .pending, fsync, rename, fsync), platform-specific atomic
replacement (MoveFileEx, renameat2, renamex_np), private-directory
hardening per OS, lock-guarded recovery, and workspace cleanup that
removes only transaction-created empty directories.

Add the Kiro IDE 1.0 plugin: strict v1 hook schema with one enabled
PreToolUse guard and PostToolUse audit pair bound to the active
workspace, agent-to-workspace identity binding in runtime config, and
exact migration of the legacy elydora-audit.kiro.hook contract.

Gates: go test ./... and -race pass, go vet clean, govulncheck reports
zero reachable vulnerabilities, git diff --check clean.

cmd/elydora/plugins/kiroide_command.go

@@ -0,0 +1,134 @@
+package plugins
+
+import (
+	"fmt"
+	"path/filepath"
+	"runtime"
+	"strings"
+)
+
+type kiroIdeRuntimeReference struct {
+	agentID    string
+	scriptPath string
+}
+
+func sameKiroIdePath(left, right string) bool {
+	left = filepath.Clean(left)
+	right = filepath.Clean(right)
+	if absolute, err := filepath.Abs(left); err == nil {
+		left = absolute
+	}
+	if absolute, err := filepath.Abs(right); err == nil {
+		right = absolute
+	}
+	if runtime.GOOS == "windows" {
+		return strings.EqualFold(left, right)
+	}
+	return left == right
+}
+
+func sameKiroIdeAgentID(left, right string) bool {
+	if runtime.GOOS == "windows" {
+		return strings.EqualFold(left, right)
+	}
+	return left == right
+}
+
+func sameKiroIdeFileName(left, right string) bool {
+	if runtime.GOOS == "windows" {
+		return strings.EqualFold(left, right)
+	}
+	return left == right
+}
+
+func buildKiroIdeCommand(runtimePath, scriptPath string) (string, error) {
+	if !filepath.IsAbs(runtimePath) || !filepath.IsAbs(scriptPath) {
+		return "", fmt.Errorf(
+			"Kiro IDE hook commands require absolute runtime and script paths",
+		)
+	}
+	if runtime.GOOS == "windows" {
+		return codexWindowsCommand(runtimePath, scriptPath), nil
+	}
+	return quotePOSIXArgument(runtimePath) + " " + quotePOSIXArgument(scriptPath), nil
+}
+
+func parseKiroIdeCommand(command string) (string, string, bool) {
+	if runtime.GOOS == "windows" {
+		return parseCodexWindowsCommand(command)
+	}
+	return parseCodexPOSIXCommand(command)
+}
+
+func kiroIdeRuntimeReferenceForCommand(
+	command string,
+	scriptName string,
+) (*kiroIdeRuntimeReference, error) {
+	runtimePath, scriptPath, ok := parseKiroIdeCommand(command)
+	if !ok || !filepath.IsAbs(runtimePath) || !filepath.IsAbs(scriptPath) ||
+		!isCodexNodeExecutable(runtimePath) ||
+		!sameKiroIdeFileName(filepath.Base(scriptPath), scriptName) {
+		return nil, nil
+	}
+	agentDirectory := filepath.Dir(scriptPath)
+	runtimeRoot, err := AgentRuntimeRoot()
+	if err != nil {
+		return nil, err
+	}
+	if !sameKiroIdePath(filepath.Dir(agentDirectory), runtimeRoot) {
+		return nil, nil
+	}
+	agentID := filepath.Base(agentDirectory)
+	if agentID == "" || agentID == "." || agentID == ".." {
+		return nil, nil
+	}
+	return &kiroIdeRuntimeReference{agentID: agentID, scriptPath: scriptPath}, nil
+}
+
+func currentKiroIdeReference(
+	hook map[string]any,
+	nodePath string,
+) (*kiroIdeRuntimeReference, error) {
+	reference, err := managedKiroIdeReference(hook)
+	if err != nil || reference == nil {
+		return reference, err
+	}
+	action := hook["action"].(map[string]any)
+	command := action["command"].(string)
+	expected, err := buildKiroIdeCommand(nodePath, reference.scriptPath)
+	if err != nil {
+		return nil, err
+	}
+	if command != expected {
+		return nil, nil
+	}
+	return reference, nil
+}
+
+func legacyKiroIdeGoReference(
+	command any,
+	scriptName string,
+) (*kiroIdeRuntimeReference, error) {
+	text, ok := command.(string)
+	if !ok || !strings.HasPrefix(text, "node ") {
+		return nil, nil
+	}
+	scriptPath := strings.TrimPrefix(text, "node ")
+	if !filepath.IsAbs(scriptPath) ||
+		!sameKiroIdeFileName(filepath.Base(scriptPath), scriptName) {
+		return nil, nil
+	}
+	agentDirectory := filepath.Dir(scriptPath)
+	runtimeRoot, err := AgentRuntimeRoot()
+	if err != nil {
+		return nil, err
+	}
+	if !sameKiroIdePath(filepath.Dir(agentDirectory), runtimeRoot) {
+		return nil, nil
+	}
+	agentID := filepath.Base(agentDirectory)
+	if agentID == "" || agentID == "." || agentID == ".." {
+		return nil, nil
+	}
+	return &kiroIdeRuntimeReference{agentID: agentID, scriptPath: scriptPath}, nil
+}