feat(extensions): add static external Hook catalog - #1716

Summary

• add a versioned, runtime-free external Hook catalog for OpenCode, Claude Code, and Codex
• inspect native configuration through bounded ecosystem adapters without importing modules, loading handlers, or executing Hook code
• expose one shared read-only snapshot through Desktop settings and the established TUI /hooks flow
• keep Server, Mobile, Remote, Peer, SDK, runtime Host, Node/Bun execution, permissions, and Hook invocation outside this PR

Architecture and ownership

The catalog does not share DTOs with executable Hook or SDK work. It contains no handler body, command, prompt, URL, environment value, credential, or other executable payload. Only semantically equivalent tool-before/tool-after events map to reviewed BitFun Hook points; other native events stay native_only, and computed or unresolved registrations stay opaque.

OpenCode inspection uses OXC only as a syntax parser. It never imports JS/TS. Named, destructured, specifier, value re-export, type-only, ambient, and declaration-file cases have explicit behavior; .d.ts files are not runtime plugin sources. Claude Code applies disableAllHooks only after observed settings layers are combined. Codex linked-worktree project Hook declarations resolve to the primary checkout, honor persisted project-root markers, and keep effective command activation unknown because session flags and trust are not observable statically.

Product behavior

• /hooks, /help hooks, /hooks -h, and /hooks --help follow the existing slash-command/help conventions; no Hook-specific namespace or shortcut is added
• normal command registration and the existing collision menu own any name conflict; the Hook feature does not introduce another router
• Desktop and TUI distinguish pending, successful empty, initial provider failure, stale last-valid data, partial diagnostics, and unsupported execution domains
• interrupted Desktop polling becomes an explicit retryable terminal state instead of displaying an endless spinner or a false empty result
• Remote workspace and Peer Device Mode fail closed with a clear unsupported state and never fall back to scanning the controller machine
• users continue editing native configuration in the source product

Concurrency, safety, and limits

Repeated refreshes reuse the existing in-flight discovery instead of queuing successor generations. Initial cache-only access starts discovery, deferred timeout completion is finalized under the existing publication gate, and provider failures cannot overwrite healthy providers.

Unknown enum values, duplicate identities, malformed source references, invalid status sets, and executable fields fail closed at the Web boundary.

Independent review

Three isolated reviews covered architecture/ownership, product behavior, and implementation/concurrency. Findings were fixed before this update, including discovery coalescing, initial/failed/stale UX, strict DTO validation, Codex worktree/root/activation semantics, Claude layered disable behavior, stable OpenCode export identities, type-only/ambient/.d.ts handling, bounded output, and stale owner comments. Final reviewers reported no remaining actionable findings.

Verification

• cargo check --workspace
• shared parser tests: 12 passed
• Claude Code Hook adapter: 5 passed
• Codex Hook adapter: 11 passed
• OpenCode Hook adapter: 19 passed
• Hook coordinator: 5 passed
• generic refresh concurrency tests: 5 passed
• Core external Hook assembly/cache tests: 5 passed
• CLI Hook command/help/output tests: 7 passed
• focused Web API/settings tests: 65 passed
• pnpm run type-check:web
• pnpm run lint:web
• pnpm run i18n:audit
• node scripts/check-core-boundaries.mjs
• pnpm run check:repo-hygiene
• pnpm run check:github-config
• git diff --check

Known output is limited to pre-existing dependency deprecation and Windows linker messages; this PR adds no new warning class.