Diagnose Codex plugin hooks for alpha.8

[Nam-Cheol]

Summary

• Fix Codex Stop hook success output so successful Stop returns {} while blocking continuation still returns the Codex blocking shape.
• Preserve and classify Codex PostToolUse string/nested tool responses without storing raw output, including direct node -e assertion evidence.
• Document the real Codex /hooks review, trusted hook discovery, final patched lifecycle run, remaining release gate blockers, and validation results.

Actual E2E

• Codex version: codex-cli 0.141.0.
• Orange/plugin version: 1.1.0-alpha.8.
• Binding fingerprint: df05c483c1e949a3065df56a4531108da6c3a1a2542eeb6583e45511a1835bd1.
• /hooks found and trusted all four Orange plugin hooks from orange-hyper-codex@orange-hyper-user: SessionStart, UserPromptSubmit, PostToolUse, and Stop.
• Final patched run observed SessionStart, UserPromptSubmit, PostToolUse, and Stop on the current fingerprint.
• The first L2 Stop requested exactly one continuation for missing verification evidence.
• After direct Node assertion evidence, the next Stop completed successfully; activate status became active and binding status became operational.
• The isolated E2E project did not gain package.json, package-lock.json, or node_modules.
• Orange stored bounded verification summaries, not raw prompt text, raw transcript, or full tool output.

Root Cause

• The earlier heartbeat-free run was inconclusive because hook trust had not been completed through the real Codex /hooks surface.
• After hook trust was completed, the first product defect was Codex Stop schema mismatch: Orange returned {"continue":true} for successful Stop, which Codex rejects.
• The second product defect was evidence classification: Codex can provide direct command output without an exit status; Orange was discarding string tool_response values and did not classify direct Node assertion success markers safely.

Release Gate

• Blocked for release in this diagnostic task.
• Resolved: plugin installed/enabled, /hooks discovery, hook review, trusted hook execution, one-shot Stop continuation, verification evidence classification, active status, and full automated validation.
• Still not re-verified in real interactive Codex after the final evidence fix: same-work Quest continuity, unrelated L1 Stop isolation, and operational status when PostToolUse is absent.
• This PR does not create a tag, GitHub Release, or npm publish.

Validation

• npm test
• npm run typecheck
• npm run check:readme-sync
• git diff --check
• node bin/orange.js --version
• node bin/orange.js env --json
• node bin/orange.js binding status --host codex --json
• node bin/orange.js activate status --host codex --json
• node bin/orange.js doctor --json
• npm run build:standalone
• dist/standalone/orange.cjs --version
• dist/standalone/orange.cjs binding status --host codex --json
• npm run build:sea
• dist/standalone/orange-macos-arm64 --version
• dist/standalone/orange-macos-arm64 binding status --host codex --json
• npm pack --dry-run with a temporary npm cache after the default user cache reported an external ownership EPERM