Add {findings} template variable to hook commands

[jzila]

Summary

• Adds a {findings} template variable to hook command interpolation, containing the full review output from the agent
• The variable is shell-escaped like all other template variables to prevent injection
• Populated on review.completed events

Test plan

• Existing interpolation tests updated and passing
• Shell injection tests extended to cover {findings}
• Full test suite passes (go test ./...)