Receive a hook event from Claude Code.

Claude Code sends structured JSON with at minimum a hook_event_name field. The event is parsed, persisted to a JSONL sidecar, and triggers side effects (heartbeat touch, completion markers, etc.).

The request body is verified against X-Bernstein-Hook-Signature-256 (HMAC-SHA256 over the raw body, keyed with BERNSTEIN_HOOK_SECRET) before any parsing or filesystem work - this is the authentication boundary for the endpoint. The session_id is then validated against a strict allowlist to prevent path traversal.

Args: session_id: Agent session identifier from the URL path. request: The incoming FastAPI request.

Returns: JSON response with status and action taken, 401 if signature verification fails, or 400 if session_id is unsafe / body is not valid JSON.