fix(security): stderr skip, independent audit, home MCP trust, dry-run conflict check

- pre-push: send skip diagnostic to stderr (not stdout) so consumers
  relying on stderr for warnings receive the message
- pre-push: move ECC_PREPUSH_AUDIT outside RUN_CHECKS gate so audit-only
  configurations still check dependencies
- mcp-health-check: classify home config paths as trusted before applying
  workspace opt-in gate; when cwd == home, ~/.claude.json was incorrectly
  blocked as untrusted workspace config
- install-global-git-hooks: check conflicting global core.hooksPath in
  dry-run mode too, so dry-run accurately reflects what apply would do

scripts/codex-git-hooks/pre-push

@@ -89,7 +89,7 @@ if [[ -f "package.json" ]]; then
   # arbitrary code execution (package.json scripts run as you). Opt-in only:
   # set ECC_PREPUSH_RUN_CHECKS=1 for repos you trust.
   if [[ "${ECC_PREPUSH_RUN_CHECKS:-0}" != "1" ]]; then
-    log "Node project detected but ECC_PREPUSH_RUN_CHECKS!=1; skipping repo script execution (set =1 to opt in)."
+    printf '[ECC pre-push] Node project detected but ECC_PREPUSH_RUN_CHECKS!=1; skipping repo script execution (set =1 to opt in).\n' >&2
   else
     pm="$(detect_pm)"
     log "Node project detected (package manager: $pm)"
@@ -104,7 +104,9 @@ if [[ -f "package.json" ]]; then
     fi
   done
 
+  fi
   if [[ "${ECC_PREPUSH_AUDIT:-0}" == "1" ]]; then
+    pm="${pm:-$(detect_pm)}"
     ran_any_check=1
     log "Running dependency audit (ECC_PREPUSH_AUDIT=1)"
     case "$pm" in
@@ -115,7 +117,6 @@ if [[ -f "package.json" ]]; then
       *) npm audit --omit=dev || fail "npm audit failed" ;;
     esac
   fi
-  fi
 fi
 
 # SECURITY: go test / pytest execute repo-controlled code (TestMain,