fix(hooks): cap PONYTAIL_SUBAGENT_MATCHER length, warn on stderr

[veltri-23]

Slim replacement for #686 (closed after maintainer feedback: the 200-line ReDoS parser was more machinery than an operator-set env var deserves).

What's left:

• PONYTAIL_SUBAGENT_MATCHER over 256 chars: ignored with a stderr warning, fail-open (inject everywhere)
• invalid regex: stderr warning on top of the existing try/catch fail-open
• tests: invalid warns, 256/257 boundary, overlong warns

51 insertions, 4 deletions across 3 files (hooks/ponytail-subagent.js, tests/hooks.test.js, README.md). Rebased on current main.

[veltri-23]

@DietrichGebert Tagging for visibility since GH didn't allow me to reopen the closed PR. I made the changes from #686 you requested.

TIA!