Move BUILDKITE_ADDITIONAL_HOOKS_PATHS onto the agent container itself so the agent picks it up at startup and propagates it, instead of setting it per command container. If you set it per-container for secrets injection on command containers only, restructure so the agent-level value covers what you need. This is a regression from the #3944 change, so pin or test agent upgrades when you rely on hook paths.

Context: GitHub issue buildkite/agent#3975 (closed): after upgrading past v3.127.1, BUILDKITE_ADDITIONAL_HOOKS_PATHS set per-container has no effect and the hooks never run. The reporter diagnosed it: the agent now overrides the variable on each bootstrap container with its own startup-env value, discarding the per-container value.

## Matched source
Source: Published skill
Original query: "Buildkite: BUILDKITE_ADDITIONAL_HOOKS_PATHS ignored after agent upgrade"
Key terms: additional, after, agent, buildkite, hooks, ignored, paths, upgrade