Hooks: tentacle-enforce false-positive — legacy edit entries never expire (re-stamped now() on read)

[magicpro97]

Summary

hooks/rules/tentacle.py _read_edits() migrates a legacy flat-set tentacle-edits marker into a legacy bucket, stamping each entry with t = now() on every read. Because the deny path returns before _write_edits() persists the migration, the marker stays in legacy format and is re-stamped fresh on every read, so _prune_ttl() (24 h TTL) never drops the entries.

Impact (Facts)

• A poisoned marker accumulated 2032 stale build-artifact paths that permanently triggered TENTACLE REQUIRED: 2032 files across 774 modules, blocking legitimate small (e.g. 3-file) edits.
• The docstring states legacy entries should "expire naturally after 24 h" — current behavior contradicts it.

Root cause

Using now() as the legacy timestamp on each read perpetually refreshes the TTL.

Fix

Stamp legacy-migrated entries with the marker file's mtime instead of now(), so they expire ~24 h after the marker was last written (matches the docstring intent).

Acceptance criteria

• Legacy entries are stamped with marker mtime, not now().
• Stale legacy markers expire via _prune_ttl.
• Regression test added.
• tests/test_hooks.py Section 17 passes.