add `dlthub ai hooks install` to set up the secrets-read guard hook for AI agents

[njaltran]

Feature description

Add a hooks subcommand to the existing dlthub ai group:

dlthub ai hooks install [--agent claude|cursor|codex] [--location URL] [--branch NAME] [--overwrite]

It installs the secrets-read guard hook (secrets_guard.py) from the AI workbench into the current project and registers it with the selected AI coding agent, following the same pattern as dlthub ai mcp install and dlthub ai toolkit install.

Use case

The AI workbench ships a secrets-read guard hook that blocks coding agents from directly reading secrets.toml / .env files, pointing them to the redacted MCP tools (secrets_view_redacted, secrets_update_fragment) instead. There is currently no way to install it via the CLI — the guard script and its per-agent installation logic live outside this repo and are duplicated, which already caused a bug fix having to land in two places by hand.

Proposed solution

• fetch secrets_guard.py from the workbench repo at install time (single source of truth, same mechanism toolkits already use) and copy it to .agents/hooks/secrets_guard.py
• merge the hook registration into the agent's config file (.claude/settings.json, .cursor/hooks.json, .codex/hooks.json) without clobbering existing settings
• idempotent: running twice is a no-op; never overwrite a user-modified script; leave unparseable config files untouched (skip with a warning) unless --overwrite
• the installed hook stays a plain python3 <path> invocation (stdlib-only script), so it works before uv sync and adds no per-tool-call overhead

Related issues

https://github.com/dlt-hub/dlthub-ai-workbench-internal/issues/54