fix(hooks): strip github: prefix from repository in update.mts

The repository values in external-tools.json include a github: prefix
(e.g. "github:zizmorcore/zizmor") which was already stripped in
index.mts but not in update.mts. This produced broken GitHub API calls
and download URLs like "repos/github:zizmorcore/zizmor/releases/latest".

Author: jdalton

.claude/hooks/setup-security-tools/update.mts

@@ -146,7 +146,7 @@ async function updateZizmor(config: Config): Promise<UpdateResult> {
     return { tool, skipped: true, updated: false, reason: 'not in config' }
   }
 
-  const repo = toolConfig.repository ?? 'zizmorcore/zizmor'
+  const repo = toolConfig.repository?.replace(/^github:/, '') ?? 'zizmorcore/zizmor'
 
   let release: GhRelease
   try {
@@ -265,7 +265,7 @@ async function updateSfwTool(
     return { tool: toolName, skipped: true, updated: false, reason: 'not in config' }
   }
 
-  const repo = toolConfig.repository
+  const repo = toolConfig.repository?.replace(/^github:/, '')
   if (!repo) {
     return { tool: toolName, skipped: true, updated: false, reason: 'no repository' }
   }