fix(apm): commit the hook ownership sidecar so fresh installs stay idempotent

apm recognises its own settings.json hook entries only through the
.claude/apm-hooks.json sidecar. With the sidecar gitignored, apm install
in a fresh clone keeps the committed SessionStart entry as user-owned and
appends a duplicate, so apm audit --ci reports drift and the apm-audit-ci
pre-push hook fails. Reproduced on main and this branch with apm 0.28.0.

Commit the sidecar in apm's exact serialisation, exclude it from
pretty-format-json alongside settings.json, and record the correction
in ADR-0019.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -40,11 +40,11 @@ apm_modules/
 /.mcp.json
 
 # APM hook deployment output — `apm install` copies each package's referenced
-# hook scripts here and tracks its own settings.json entries in the sidecar.
-# Regenerated on every install; the authoring source is
-# plugins/<name>/.apm/hooks/ (ADR-0019).
+# hook scripts here. Regenerated on every install; the authoring source is
+# plugins/<name>/.apm/hooks/ (ADR-0019). The .claude/apm-hooks.json ownership
+# sidecar is committed, not ignored: without it a fresh clone's install cannot
+# claim the committed settings.json entry and duplicates it (ADR-0019).
 .claude/hooks/
-.claude/apm-hooks.json
 
 # `apm pack` bundle output. The pre-push gate runs pack with --dry-run, so this
 # only appears after a bare `apm pack` during a release; it is not repo content.