[gemini133]

Summary

• Adds native Codex PreToolUse hook handling for Bash commands.
• Adds rtk init --codex --auto-patch install/uninstall support for
  $CODEX_HOME/hooks.json.
• Emits Codex-compatible allow, deny, and no-decision responses.

Extends #377 (feat(init): add Codex CLI support via AGENTS.md + RTK.md workflow) from advisory setup files to Codex's native hook protocol.

Problem

Codex hook output has stricter schema requirements than Claude-style rewrite
responses. In particular, Codex rejects updatedInput unless the same response
also has permissionDecision: "allow". A deny response must include a reason
and must not include updatedInput.

Without native support, Codex Bash commands either stay raw or risk invalid hook
JSON when RTK attempts to rewrite them.

Behavior Changes

Codex PreToolUse case	Before	After
Default/ask rule, command git status	A rewrite response can be invalid for Codex.	stdout {}; Codex runs raw git status.
Explicit allow Bash(git *), command git status	Command stays raw.	Emits permissionDecision: "allow" and updatedInput.command = "rtk git status".
Explicit deny Bash(git status)	Deny cannot be represented safely by the old path.	Emits permissionDecision: "deny" with a reason and no updatedInput.
rtk init --codex --auto-patch with existing hooks	No native RTK Codex hook upsert.	Adds/removes only the RTK-managed entry; foreign entries remain.

Implementation

• Adds rtk hook codex.
• Adds Codex-specific hook response construction in src/hooks/hook_cmd.rs.
• Adds Codex hook constants and an _rtk_managed marker for install hygiene.
• Adds Codex install, upsert, and uninstall helpers in src/hooks/init.rs.
• Preserves non-Bash and malformed payloads as no-decision responses.

Compatibility Notes

• No updatedInput is emitted unless Codex receives
  permissionDecision: "allow".
• Deny responses include permissionDecisionReason and omit updatedInput.
• Existing non-RTK hooks.json entries are preserved.
• Protocol stderr cleanliness is handled by the separate hook-warning cleanup
  PR; the Codex schema behavior here is independent.

Test Plan

• cargo test -q codex
• cargo fmt --all --check
• cargo clippy --all-targets
• cargo test
• git diff --check

Expected installed behavior:

default/no explicit allow
=> {}

allow rule Bash(git *)
=> permissionDecision=allow with updatedInput.command="rtk git status"

deny rule Bash(git status)
=> permissionDecision=deny with no updatedInput