chore(cli): drop unused NPX import + silence false-positive npx hook

- with-subcommands-help.mts: NPX import became dead after the
  per-app bucket-map refactor (commit 277737e). Remove it so the
  type checker is clean again.
- cmd-npx.mts: add the canonical `// socket-hook: allow npx` marker
  on the literal description string so the pre-commit security
  scanner stops flagging the command name.

Author: jdalton

packages/cli/src/commands/npx/cmd-npx.mts

@@ -10,7 +10,7 @@ import { defineHandoffCommand } from '../../utils/cli/define-handoff.mts'
 
 export const cmdNpx = defineHandoffCommand({
   name: NPX,
-  description: 'Run npx with Socket Firewall security',
+  description: 'Run npx with Socket Firewall security', // socket-hook: allow npx
   spawnMode: 'auto',
   examples: ['cowsay', 'cowsay@1.6.0 hello'],
   showApiRequirements: true,

packages/cli/src/utils/cli/with-subcommands-help.mts

@@ -30,7 +30,7 @@ import {
   FLAG_JSON,
   FLAG_MARKDOWN,
 } from '../../constants/cli.mts'
-import { NPM, NPX } from '../../constants/agents.mts'
+import { NPM } from '../../constants/agents.mts'
 import { API_V0_URL } from '../../constants/socket.mts'
 import { getFlagListOutput, getHelpListOutput } from '../output/formatting.mts'
 import { socketPackageLink } from '../terminal/link.mts'