- orchestrate-codex-worker: pass approval policy via --ask-for-approval,
not -p profile
- codex global hooks: validate conflicting global hooksPath before backup/copy,
so refused install is side-effect free
- claw: reject percent-delimited Windows paths in cmd.exe fallback to avoid
%NAME% expansion
- codex-hooks: opt into ECC_PREPUSH_RUN_CHECKS=1 in existing verification
fixtures and add default-skip coverage