fix: add guards to reject built-in source in hooks message handlers

Add runtime guards in 5 hooks message handlers to reject 'built-in'
source before calling HooksService methods. This fixes TypeScript
error where message.source has type 'global | project | built-in'
but HooksService methods only accept 'global | project'.

Built-in hooks are read-only and cannot be modified, deleted,
reordered, moved, or have their folder opened.

Handlers updated:
- hooks/save
- hooks/delete
- hooks/reorder
- hooks/move
- hooks/openFolder

Author: taltas

src/core/webview/webviewMessageHandler.ts

@@ -3372,6 +3372,9 @@ export const webviewMessageHandler = async (
 				if (!message.hook || !message.eventType || !message.source) {
 					throw new Error("Missing required fields: hook, eventType, source")
 				}
+				if (message.source === "built-in") {
+					throw new Error("Cannot modify built-in hooks")
+				}
 				await hooksService.saveHook(message.hook, message.eventType, message.source)
 				// Reload and send updated hooks
 				const hooks = await hooksService.loadHooks()
@@ -3393,6 +3396,9 @@ export const webviewMessageHandler = async (
 				if (!message.hookId || !message.eventType || !message.source) {
 					throw new Error("Missing required fields: hookId, eventType, source")
 				}
+				if (message.source === "built-in") {
+					throw new Error("Cannot delete built-in hooks")
+				}
 				await hooksService.deleteHook(message.hookId, message.eventType, message.source)
 				// Reload and send updated hooks
 				const hooks = await hooksService.loadHooks()
@@ -3414,6 +3420,9 @@ export const webviewMessageHandler = async (
 				if (!message.eventType || !message.hookIds || !message.source) {
 					throw new Error("Missing required fields: eventType, hookIds, source")
 				}
+				if (message.source === "built-in") {
+					throw new Error("Cannot reorder built-in hooks")
+				}
 				await hooksService.reorderHooks(message.eventType, message.hookIds, message.source)
 				// Reload and send updated hooks
 				const hooks = await hooksService.loadHooks()
@@ -3435,6 +3444,9 @@ export const webviewMessageHandler = async (
 				if (!message.hook || !message.fromEventType || !message.toEventType || !message.source) {
 					throw new Error("Missing required fields: hook, fromEventType, toEventType, source")
 				}
+				if (message.source === "built-in") {
+					throw new Error("Cannot move built-in hooks")
+				}
 				await hooksService.moveHook(message.hook, message.fromEventType, message.toEventType, message.source)
 				// Reload and send updated hooks
 				const hooks = await hooksService.loadHooks()
@@ -3456,6 +3468,9 @@ export const webviewMessageHandler = async (
 				if (!message.source) {
 					throw new Error("Missing required field: source")
 				}
+				if (message.source === "built-in") {
+					throw new Error("Cannot open folder for built-in hooks")
+				}
 				await hooksService.openHooksFolder(message.source)
 			} catch (error) {
 				const errorMessage = error instanceof Error ? error.message : String(error)