fix: point statusline setup nudge at CLAUDE_CONFIG_DIR/settings.json

[halindrome]

What

The statusline setup nudge in ponytail-activate.js hardcoded ~/.claude/settings.json. When CLAUDE_CONFIG_DIR is set, settings live elsewhere, so the nudge pointed at the wrong file.

How

Use the already-resolved settingsPath (honors CLAUDE_CONFIG_DIR via getClaudeDir()) in both nudge branches. Test asserts the nudge references CLAUDE_CONFIG_DIR/settings.json and not ~/.claude/settings.json.

npm test passes.

Closes #255

[halindrome]

QA Round 1

Contract source: issue #255. Branch synced (already up-to-date with main). Schema change: none. SAST: skipped (code scanning not enabled on repo).

The fix is correct and minimal. Both source nudge branches now interpolate the resolved settingsPath (path.join(getClaudeDir(), 'settings.json'), which honors CLAUDE_CONFIG_DIR). The new test is a genuine regression guard — verified it fails when the source fix is reverted, so it is not a tautology. No blocking issues.

Finding 1: Manual-fallback nudge branch is fixed but never tested — [claude]

• Area: hooks/ponytail-activate.js (~lines 72–81), tests/hooks.test.js
• Risk: The nudge has two branches gated on isShellSafe(scriptPath). The test always runs from the real repo hooks dir (shell-safe), so it only exercises the shell-safe branch; the manual-fallback branch is fixed in source but has zero coverage. A future re-hardcode there wouldn't be caught.
• Severity: minor · Status: confirmed (coverage gap, not a correctness bug)

Finding 2: Default case (CLAUDE_CONFIG_DIR unset) nudge text not asserted — [claude]

• Area: tests/hooks.test.js
• Risk: New nudge assertions live only in the CLAUDE_CONFIG_DIR-set block. Behavior when unset is correct (getClaudeDir() falls back to ~/.claude, so settingsPath resolves to an absolute <home>/.claude/settings.json), but it isn't asserted.
• Severity: minor · Status: confirmed (coverage gap)

Contract Verification

Criterion	Verdict	Evidence
Nudge uses resolved settingsPath not literal ~/.claude/settings.json	pass	activate.js both nudge sites interpolate settingsPath
Both nudge branches fixed	pass (source) / partial (test)	Both edited in source; only shell-safe branch test-exercised
Test asserts nudge references CLAUDE_CONFIG_DIR/settings.json and not ~/.claude/settings.json	pass	Confirmed the assertion fails when the fix is reverted

Schema Change

No schema-affecting files or DDL detected.

Summary

Severity	Count
Critical	0
Major	0
Minor	2
Total	2

---

SAST review skipped

Code scanning is not available for DietrichGebert/ponytail (no enabled CodeQL/SARIF analysis). No SAST delta computed — graceful skip. Dependabot alerts unavailable (not enabled or token scope). Non-blocking.

---

QA performed by Claude Code (claude-opus-4-8). Note: the global pr-qa-reviewer sub-agent was not registered in this session (CLAUDE_CONFIG_DIR/agents not loaded); review ran via the general-purpose agent with the identical reviewer contract.