Fix Cursor plugin hook and install behavior

[hopeatina]

Summary

• fix local install to link the plugin root with fileURLToPath and the marketplace name orgx
• stop persisting raw transcript paths or sensitive payload key names in Work Graph hook records
• surface hook spool failures with non-zero exits instead of silently succeeding
• extend plugin verification to guard these behaviors

Verification

• npm run verify
• node -e hook behavior check for transcript path redaction and failed spool exit code
• git diff --check

Context

These fixes address Cursor Bugbot feedback on cursor/plugins#72 before the OrgX plugin is accepted into the public Cursor plugins catalog.