feat(install): require an explicit hook decision at the apply layer

The guided installer asks how ECC hooks should run, but that consent
lived only in the wizard path. Running install-apply directly with a
profile that includes hooks-runtime still materialized the hook runtime
with no disclosure and no decision.

Gate the apply layer instead, so every entry point is covered:

- disclose the six hook capability groups when a plan would materialize
  the hook runtime, and refuse to apply until the caller decides
- --enable-hooks confirms the hook runtime; --no-hooks installs the rest
  of the selection without it and records the reduced module closure in
  install-state
- surface the pending decision as a dry-run warning
- show the same capability disclosure in the guided installer's plan
  preview, so the wizard's hook question states what it is asking about

Plans that never materialize hooks (Kimi, --profile minimal,
--without baseline:hooks) are unaffected and need no flag. Repair and
uninstall operate on already-recorded state and stay unchanged.

The capability taxonomy and the held-materialization behavior come from
Samarjeet Singh Tomar's PR #2634, reworked to fit the single-decision
consent model that shipped with the guided installer in #2649.

Co-Authored-By: Samarjeet Singh Tomar <samar_tomar@hotmail.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/scripts/install-guided.test.js

@@ -8,6 +8,7 @@ const {
   collectInteractiveOptions,
   main,
   parseArgs,
+  printPlan,
   validateExecutionMode,
 } = require('../../scripts/install-guided');
 const {
@@ -361,6 +362,28 @@ function runGuidedPtyFixture(answers) {
     assert.doesNotMatch(errorOutput.read(), /\[31m/);
   });
 
+  await test('printPlan discloses hook capabilities for non-off Claude hook profiles', async () => {
+    let written = '';
+    const output = { write: chunk => { written += chunk; } };
+    printPlan({
+      harnesses: [{ id: 'claude', channel: 'native-plugin' }],
+      request: { harnesses: ['claude'], claudeHooks: 'standard' },
+    }, output);
+    assert.ok(written.includes("hook profile 'standard'"));
+    assert.ok(written.includes('modify project source files'));
+    assert.ok(written.includes("--claude-hooks off"));
+  });
+
+  await test('printPlan omits the hook disclosure when Claude hooks are off', async () => {
+    let written = '';
+    const output = { write: chunk => { written += chunk; } };
+    printPlan({
+      harnesses: [{ id: 'claude', channel: 'native-plugin' }],
+      request: { harnesses: ['claude'], claudeHooks: 'off' },
+    }, output);
+    assert.ok(!written.includes('enables automation'));
+  });
+
   console.log(`\nResults: Passed: ${passed}, Failed: ${failed}`);
   process.exitCode = failed > 0 ? 1 : 0;
 })();