fix(hooks): enable image-read blocking by default for third-party profiles

Match WebSearch hook pattern:
- ENABLED by default for settings/cliproxy profiles
- DISABLED for native Claude accounts (account/default)
- User can override via config: hooks.block_image_read.enabled: false

This ensures CCS CLI users get context protection out-of-the-box
while native Claude subscription users are unaffected.

src/utils/hooks/image-read-block-hook-env.ts

@@ -4,6 +4,9 @@
  * Provides environment variables for image read blocking hook configuration.
  * Prevents context overflow when skills generate images and agent tries to read them.
  *
+ * Enabled by default for third-party profiles (settings, cliproxy).
+ * Disabled for native Claude accounts where context is managed server-side.
+ *
  * @module utils/hooks/image-read-block-hook-env
  */
 
@@ -13,13 +16,13 @@ import { loadOrCreateUnifiedConfig } from '../../config/unified-config-loader';
  * Configuration for image read blocking.
  */
 export interface ImageReadBlockConfig {
-  /** Whether blocking is enabled */
+  /** Whether blocking is enabled (default: true) */
   enabled: boolean;
 }
 
 /**
  * Get image read block configuration from unified config.
- * Defaults to disabled (opt-in feature).
+ * Defaults to ENABLED (opt-out feature) - matches WebSearch pattern.
  */
 export function getImageReadBlockConfig(): ImageReadBlockConfig {
   const config = loadOrCreateUnifiedConfig();
@@ -28,14 +31,18 @@ export function getImageReadBlockConfig(): ImageReadBlockConfig {
     config as unknown as { hooks?: { block_image_read?: { enabled?: boolean } } }
   ).hooks;
   return {
-    // Default to false - must be explicitly enabled
-    enabled: hooksConfig?.block_image_read?.enabled ?? false,
+    // Default to TRUE - enabled by default, user can opt-out
+    enabled: hooksConfig?.block_image_read?.enabled ?? true,
   };
 }
 
 /**
  * Get environment variables for image read block hook configuration.
  *
+ * Like WebSearch, this respects CCS_PROFILE_TYPE:
+ * - 'account' or 'default' profiles: Skip blocking (native Claude)
+ * - 'settings' or 'cliproxy' profiles: Apply blocking
+ *
  * @returns Record of environment variables to set before spawning Claude
  */
 export function getImageReadBlockHookEnv(): Record<string, string> {
@@ -44,6 +51,9 @@ export function getImageReadBlockHookEnv(): Record<string, string> {
 
   if (config.enabled) {
     env.CCS_BLOCK_IMAGE_READ = '1';
+  } else {
+    // Explicit disable signal
+    env.CCS_BLOCK_IMAGE_READ = '0';
   }
 
   return env;