[codex] Add executable agent hook augmentation

[sameer2191]

Summary

Adds real executable RepoLens agent hook support for hook-capable coding agents:

• new agent-hook / hook-augment CLI entrypoint that reads hook payload JSON from stdin
• broad-search detection for PreToolUse-style Grep, Glob, and shell search commands
• Claude-compatible hookSpecificOutput.additionalContext rendering
• explicit skip behavior for Read/Edit/Write/MultiEdit so the hook does not intercept direct file operations
• opt-in --with-query graph metadata augmentation, with the default path avoiding local graph DB reads/writes
• POSIX single-quote rendering for generated fallback commands and setup-guide commands
• managed .claude/settings.local.json PreToolUse hook install/update/uninstall under install-agents --with-hooks --agents claude, preserving unrelated Claude hooks/settings

Why

The reference repo exposes executable pre-tool hook behavior, while RepoLens previously generated reminder files only. This closes that practical integration gap and makes install-agents --with-hooks useful for real agent workflows without making hooks blocking or surprising by default.

Security and behavior notes

• Hook payloads fail open on malformed JSON or unsupported events.
• Default hook execution only parses stdin and emits guidance; graph lookup is explicit via --with-query.
• Fallback commands are shell-quoted to prevent $(), backtick, semicolon, newline, and DB-path metacharacter expansion.
• Claude hook config uses exec-form command plus args, avoiding shell tokenization in installed hook settings.
• Direct file tools are skipped and tested.

Validation

• npm run build
• node --test --experimental-sqlite dist/tests/agent-hooks.test.js dist/tests/agent-setup.test.js -> 16 focused tests passing
• npm run verify -> 73 tests, 72 passing, 1 documented dashboard socket skip
• npm run test:skip-gate
• npm run package:check -> 92 files inspected
• npm pack --dry-run --json -> 200,896 bytes packed, 1,029,092 bytes unpacked, 92 entries
• npm run audit:prod -> 0 vulnerabilities
• git diff --check
• hook smoke: default hook-augment --claude, opt-in --with-query, and skipped Read payload
• public wording scan for recruiter/career/proof/impress/job/LinkedIn/reference-copy terms