[codex] Improve Codex plugin hook trust doctor (#258)

* feat(codex): report per-hook trust state in doctor

Inspect Codex `config.toml` [hooks.state] and report which managed
hooks still lack a sha256 trust entry, instead of a generic `/hooks`
reminder. Drops the obsolete config-managed doctor paths.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(codex): migrate legacy config install to plugin bundle

update_plugin now migrates a legacy config-only Codex install to the
plugin bundle and sweeps the old config, rather than reporting
ConfigOnly. Project-local Codex installs no longer ship hooks/hooks.json.

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor(codex): finish hook migration cleanup

* refactor(codex): simplify hook trust doctor flow

* test(codex): align repo-local install tests with hook-less bundle

Repo-local Codex installs intentionally stop shipping hooks/hooks.json
(Codex only trusts personal-plugin hooks), but two tests still asserted
the old layout. assert_codex_rendered_bundle_valid now takes an
expect_hooks flag (asserting absence for repo-local bundles), and the
codex local-install path list drops hooks/hooks.json.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(codex): centralize bundle scope policy

Make hook assertions scope-explicit and address review findings:
assert_codex_bundle_contains_bin silently skipped hook validation when
hooks/hooks.json was absent, letting global refresh tests pass even if
hooks stopped rendering; and the global-vs-repo-local scope policy was
scattered as ad-hoc conditionals across bundle writing, manifest/MCP
mutation, and the doctor.

- Add CodexBundlePolicy (include_hooks, mcp_args, mcp_env,
  hook_trust_config_path, include_memory_digest) consumed by the bundle
  writer, renderers, and doctor; collapse doctor_check_plugin's
  duplicated manifest/version/MCP checks into doctor_check_plugin_dir,
  which now warns if a repo-local bundle unexpectedly ships hooks.
- Tests take an explicit CodexScope: global bundles must ship
  hooks/hooks.json, repo-local bundles must not; repo-local rendered
  bundles keep the placeholder and source-coverage checks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(codex): review fixes for hook trust doctor migration

Review findings on the migration/doctor flow:

- update_plugin could sweep a working legacy config-managed global
  install while only a repo-local bundle refreshed, leaving no personal
  plugin as replacement; the bootstrap now installs whenever a legacy
  migration runs, and the sweep prints the required
  `codex plugin add tracedecay@personal` next step
- local-only installs (repo bundle, no personal plugin) got an all-green
  doctor with zero lifecycle hooks anywhere; healthcheck now warns that
  repo-local bundles ship no hooks
- the trusted-state info line now says trust is pinned to hook content,
  so a post-update hooks.json rewrite prompts a /hooks re-trust instead
  of reading as all-clear
- config.toml delete-if-empty now takes the same backup as the rewrite
  path; uninstall_hooks only rewrites and reports when it removed entries
- hook state keys derive from the managed hook's subcommand instead of a
  hand-rolled CamelCase converter that would break on acronym events

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(codex): apply review cleanups to trust doctor plumbing

- codex_config_path centralizes the four hand-built ~/.codex/config.toml
  joins
- codex_plugin_hook_trust_state treats a missing [hooks.state] table as
  empty so one pipeline produces the missing list
- stamp_manifest_version_with lets Codex strip the repo-local hooks key
  on the already-parsed manifest instead of a second JSON round-trip
- update_plugin folds the duplicated personal-bootstrap branches into
  one needs-personal condition

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: ScriptedAlchemy