test: add regression checks for security shield hook registration

cmd/picoclaw/main_test.go

@@ -10,7 +10,9 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/sipeed/picoclaw/cmd/picoclaw/internal"
+	"github.com/sipeed/picoclaw/pkg/agent"
 	"github.com/sipeed/picoclaw/pkg/config"
+	"github.com/sipeed/picoclaw/pkg/security"
 )
 
 func TestNewPicoclawCommand(t *testing.T) {
@@ -61,3 +63,24 @@ func TestNewPicoclawCommand(t *testing.T) {
 		assert.False(t, subcmd.Hidden)
 	}
 }
+
+func TestSecurityShieldRegistration_Regression(t *testing.T) {
+	// Initialize security hooks (registers them in pkg/agent)
+	security.Init()
+
+	expectedHooks := []string{
+		"security_policy",
+		"security_canary",
+		"security_behavior",
+		"security_pii",
+		"security_ipia",
+	}
+
+	for _, name := range expectedHooks {
+		t.Run(name, func(t *testing.T) {
+			assert.True(t, agent.IsBuiltinHookRegistered(name),
+				"Builtin hook %q is not registered. This usually means pkg/security was deleted "+
+					"or security.Init() is no longer called in main().", name)
+		})
+	}
+}

pkg/agent/hook_mount.go

@@ -76,6 +76,14 @@ func RegisterBuiltinHook(name string, factory BuiltinHookFactory) error {
 	return nil
 }
 
+// IsBuiltinHookRegistered returns true if a builtin hook factory is registered with the given name.
+func IsBuiltinHookRegistered(name string) bool {
+	builtinHookRegistryMu.RLock()
+	defer builtinHookRegistryMu.RUnlock()
+	_, exists := builtinHookRegistry[name]
+	return exists
+}
+
 func unregisterBuiltinHook(name string) {
 	if name == "" {
 		return