docs: fix security-guidance plugin entry in plugins/README.md

[Woohyeon-Hong]

Summary

plugins/README.md's security-guidance entry claims a single PreToolUse hook monitoring 9 security patterns. Neither claim holds: the plugin has no PreToolUse hook, and its pattern list has 25 entries, not 9. The entry also collapses three functionally distinct triggers (regex warnings, an agentic multi-file review on commit/push, and a full-diff review on Stop) into one line. This PR rewrites the entry to match the actual hooks.json registration.

Files changed

plugins/README.md (line 27)

Verification

Setup: fresh checkout of main; compared the table entry against plugins/security-guidance/hooks/hooks.json and plugins/security-guidance/hooks/patterns.py.

Details: hooks.json has no PreToolUse key; it registers SessionStart, UserPromptSubmit, PostToolUse (two matcher groups — Edit|Write|MultiEdit|NotebookEdit, and Bash with if: git commit/push), and Stop. patterns.py's SECURITY_PATTERNS list has 25 dicts with a "ruleName" key (lines 32-255); a naive grep -c '"ruleName"' returns 26 because of an unrelated assert at line 330 that also references the key.

Comparisons

README claim	Backing in hooks.json / patterns.py	Action
"Hook: PreToolUse"	no PreToolUse key anywhere	reworded to PostToolUse / Stop
"Monitors 9 security patterns"	25 "ruleName" entries in SECURITY_PATTERNS	corrected to ~25
(not mentioned)	agentic multi-file review on git commit/git push (PostToolUse, Bash matcher)	added
(not mentioned)	full-session-diff LLM review (Stop hook)	added

Refs

Fixes #81573