feat: deterministic Stop hook for iteration completion (`nous-execute-stop`)

[sriumcp]

TL;DR

A deterministic Stop hook (shell-script-based, not LLM-based) that runs nous validate --execution after each tool burst and signals "stop, work complete" only when validation passes. More reliable and cheaper than the agent self-deciding when to stop.

Why this matters

Today the executor decides on its own when to stop ("I've written findings.json, I'm done"). Sometimes it keeps writing. Sometimes it stops too early. Stop hooks are deterministic — a shell script returning 0 = continue, non-zero with a reason = stop.

What's already shipped

• nous validate from feat: nous validate CLI + executor writes artifacts directly #54 already encapsulates the validation logic.
• This issue wires it into the agent loop as a hook.

Proposed approach

1. Implement bin/nous-execute-stop — a small shell script that runs nous validate --dir <iter-dir> --execution and [ -f <iter-dir>/principle_updates.json ]. Exits 0 if both pass.
2. Register it as a Stop hook for the executor agent (in the per-campaign .claude/settings.json, depends on Test issue #15).
3. When the hook signals "stop", the agent terminates cleanly. When it doesn't, the agent gets the validation diff back as a structured message and continues.

Acceptance criteria

• On the first pass that produces a valid findings.json + principle_updates.json, the executor exits within one turn of the hook firing.
• If validation fails, the next executor turn includes the schema diff (not a re-run from scratch).

Notes

• This pairs with Framework buildout: structured 4-layer approach from protocol to autonomous orchestrator #4's /goal mode but is distinct: this is deterministic (validation pass/fail), /goal is probabilistic (Haiku evaluator). Use the deterministic one wherever possible.

---

Part of #120.

[sriumcp]

Closed by #153 (squash-merge 3e69b85, merged into reflective 2026-05-24). The merged commit message contains an explicit Closes #129. GitHub auto-close didn't fire because the PR targets reflective rather than the repo's default branch.