docs: typography hygiene across 4 large pages

Replaced 152 typography characters (curly quotes, apostrophes, em/en
dashes, non-breaking hyphens) with ASCII equivalents so grep,
copy-paste, and Mintlify search hit clean tokens. Per docs/CLAUDE.md
heading and content hygiene rules.

- docs/gateway/security/index.md: 59 chars
- docs/plugins/hooks.md: 34 chars
- docs/reference/session-management-compaction.md: 30 chars
- docs/tools/clawhub.md: 29 chars

docs/plugins/hooks.md

@@ -54,8 +54,8 @@ keep registration order.
 
 `api.on(name, handler, opts?)` accepts:
 
-- `priority` — handler ordering (higher runs first).
-- `timeoutMs` — optional per-hook budget. When set, the hook runner aborts that
+- `priority` - handler ordering (higher runs first).
+- `timeoutMs` - optional per-hook budget. When set, the hook runner aborts that
   handler after the budget elapses and continues with the next one, instead of
   letting slow setup or recall work consume the caller's configured model
   timeout. Omit it to use the default observation/decision timeout that the
@@ -100,52 +100,52 @@ observation-only.
 
 **Agent turn**
 
-- `before_model_resolve` — override provider or model before session messages load
-- `agent_turn_prepare` — consume queued plugin turn injections and add same-turn context before prompt hooks
-- `before_prompt_build` — add dynamic context or system-prompt text before the model call
-- `before_agent_start` — compatibility-only combined phase; prefer the two hooks above
-- **`before_agent_reply`** — short-circuit the model turn with a synthetic reply or silence
-- **`before_agent_finalize`** — inspect the natural final answer and request one more model pass
-- `agent_end` — observe final messages, success state, and run duration
-- `heartbeat_prompt_contribution` — add heartbeat-only context for background monitor and lifecycle plugins
+- `before_model_resolve` - override provider or model before session messages load
+- `agent_turn_prepare` - consume queued plugin turn injections and add same-turn context before prompt hooks
+- `before_prompt_build` - add dynamic context or system-prompt text before the model call
+- `before_agent_start` - compatibility-only combined phase; prefer the two hooks above
+- **`before_agent_reply`** - short-circuit the model turn with a synthetic reply or silence
+- **`before_agent_finalize`** - inspect the natural final answer and request one more model pass
+- `agent_end` - observe final messages, success state, and run duration
+- `heartbeat_prompt_contribution` - add heartbeat-only context for background monitor and lifecycle plugins
 
 **Conversation observation**
 
-- `model_call_started` / `model_call_ended` — observe sanitized provider/model call metadata, timing, outcome, and bounded request-id hashes without prompt or response content
-- `llm_input` — observe provider input (system prompt, prompt, history)
-- `llm_output` — observe provider output
+- `model_call_started` / `model_call_ended` - observe sanitized provider/model call metadata, timing, outcome, and bounded request-id hashes without prompt or response content
+- `llm_input` - observe provider input (system prompt, prompt, history)
+- `llm_output` - observe provider output
 
 **Tools**
 
-- **`before_tool_call`** — rewrite tool params, block execution, or require approval
-- `after_tool_call` — observe tool results, errors, and duration
-- **`tool_result_persist`** — rewrite the assistant message produced from a tool result
-- **`before_message_write`** — inspect or block an in-progress message write (rare)
+- **`before_tool_call`** - rewrite tool params, block execution, or require approval
+- `after_tool_call` - observe tool results, errors, and duration
+- **`tool_result_persist`** - rewrite the assistant message produced from a tool result
+- **`before_message_write`** - inspect or block an in-progress message write (rare)
 
 **Messages and delivery**
 
-- **`inbound_claim`** — claim an inbound message before agent routing (synthetic replies)
-- `message_received` — observe inbound content, sender, thread, and metadata
-- **`message_sending`** — rewrite outbound content or cancel delivery
-- `message_sent` — observe outbound delivery success or failure
-- **`before_dispatch`** — inspect or rewrite an outbound dispatch before channel handoff
-- **`reply_dispatch`** — participate in the final reply-dispatch pipeline
+- **`inbound_claim`** - claim an inbound message before agent routing (synthetic replies)
+- `message_received` - observe inbound content, sender, thread, and metadata
+- **`message_sending`** - rewrite outbound content or cancel delivery
+- `message_sent` - observe outbound delivery success or failure
+- **`before_dispatch`** - inspect or rewrite an outbound dispatch before channel handoff
+- **`reply_dispatch`** - participate in the final reply-dispatch pipeline
 
 **Sessions and compaction**
 
-- `session_start` / `session_end` — track session lifecycle boundaries
-- `before_compaction` / `after_compaction` — observe or annotate compaction cycles
-- `before_reset` — observe session-reset events (`/reset`, programmatic resets)
+- `session_start` / `session_end` - track session lifecycle boundaries
+- `before_compaction` / `after_compaction` - observe or annotate compaction cycles
+- `before_reset` - observe session-reset events (`/reset`, programmatic resets)
 
 **Subagents**
 
-- `subagent_spawning` / `subagent_delivery_target` / `subagent_spawned` / `subagent_ended` — coordinate subagent routing and completion delivery
+- `subagent_spawning` / `subagent_delivery_target` / `subagent_spawned` / `subagent_ended` - coordinate subagent routing and completion delivery
 
 **Lifecycle**
 
-- `gateway_start` / `gateway_stop` — start or stop plugin-owned services with the Gateway
-- `cron_changed` — observe gateway-owned cron lifecycle changes (added, updated, removed, started, finished, scheduled)
-- **`before_install`** — inspect skill or plugin install scans and optionally block
+- `gateway_start` / `gateway_stop` - start or stop plugin-owned services with the Gateway
+- `cron_changed` - observe gateway-owned cron lifecycle changes (added, updated, removed, started, finished, scheduled)
+- **`before_install`** - inspect skill or plugin install scans and optionally block
 
 ## Tool call policy
 
@@ -188,7 +188,7 @@ Rules:
   approvals. The `/approve` command can approve both exec and plugin approvals.
 - A lower-priority `block: true` can still block after a higher-priority hook
   requested approval.
-- `onResolution` receives the resolved approval decision — `allow-once`,
+- `onResolution` receives the resolved approval decision - `allow-once`,
   `allow-always`, `deny`, `timeout`, or `cancelled`.
 
 Bundled plugins that need host-level policy can register trusted tool policies
@@ -397,14 +397,14 @@ before the next major release:
   `PluginApprovalResolution` union (`allow-once` / `allow-always` / `deny` /
   `timeout` / `cancelled`) instead of a free-form `string`.
 
-For the full list — memory capability registration, provider thinking
+For the full list - memory capability registration, provider thinking
 profile, external auth providers, provider discovery types, task runtime
-accessors, and the `command-auth` → `command-status` rename — see
+accessors, and the `command-auth` → `command-status` rename - see
 [Plugin SDK migration → Active deprecations](/plugins/sdk-migration#active-deprecations).
 
 ## Related
 
-- [Plugin SDK migration](/plugins/sdk-migration) — active deprecations and removal timeline
+- [Plugin SDK migration](/plugins/sdk-migration) - active deprecations and removal timeline
 - [Building plugins](/plugins/building-plugins)
 - [Plugin SDK overview](/plugins/sdk-overview)
 - [Plugin entry points](/plugins/sdk-entrypoints)