fix: stop shipping no-op hooks to Codex and quote hook paths

[JakeRuth]

Problem

• Codex users who install this plugin from the git marketplace must review and trust two hooks before Codex starts ("Hooks need review. 2 hooks are new or changed.").
• Both hooks do nothing on Codex. The write gate exits early there because Codex rejects permissionDecision: "ask", and the SessionEnd hook only reads Claude Code transcripts under ~/.claude.
• Codex also prints "clamping SessionEnd hook timeout to 3s" on every launch, because the SessionEnd hook declares a 30 s timeout.
• On Claude Code, the hook commands break when the plugin path contains a space, and every tool call in the session is blocked (Unquoted ${CLAUDE_PLUGIN_ROOT} in hooks.json blocks every tool call when the plugin path contains a space #179). macOS paths under Application Support hit this.

Changes

• Codex users no longer see the hook review gate or the timeout warning. The Codex manifest now points hooks at an empty hooks/codex-hooks.json, which replaces Codex's default discovery of hooks/hooks.json.
• Claude Code users with a space in the plugin path get working hooks instead of blocked tool calls. Both command strings in hooks/hooks.json now quote the path.
• Claude Code behavior is otherwise unchanged. Claude never reads the Codex manifest and still loads hooks/hooks.json.
• Skills are untouched. Both harnesses still load the full bundled catalog.

Note

"hooks": [] in the Codex manifest does not work on Codex 0.149.0: Codex treats it as absent and falls back to hooks/hooks.json. Pointing hooks at a file is the documented override: "If you define hooks in .codex-plugin/plugin.json, Codex uses that manifest entry instead of the default hooks/hooks.json." The docs do not cover an empty file. That it loads zero hooks follows from the loader and was verified on 0.149.0 (/hooks lists none).

Testing

Verified on Codex 0.149.0 and Claude Code, installing the plugin from a local marketplace built from this branch:

• Codex before: hook review gate at startup, clamp warning, /hooks shows 2 installed. After: no gate, no warning, /hooks shows 0 installed, skills still listed.
• Claude Code with --plugin-dir: the debug log shows "Registered 2 hooks from 1 plugins" and "Loaded 137 skills from plugin posthog".
• Space-in-path repro: with CLAUDE_PLUGIN_ROOT under a directory containing a space, the old command exits 2 (Claude's block code) and the quoted one exits 0 and returns the gate's ask decision.
• Not run: Windows.

Closes #179.

Context: https://posthog.slack.com/archives/C09SK2PAGKF/p1788189196906069

🤖 Agent context

Claude Code (Fable 5) drafted the change and ran the verification with the author driving each harness. Skills invoked: writing-pr-descriptions.