fix(codex): use renamed hooks feature

[VitalyAnkh]

This updates the Codex install path for the native hook feature rename.

• codex_hooks is now treated as the legacy name. If it appears in config.toml, the installer fails with an upgrade hint.
• If the installed Codex CLI only exposes codex_hooks, the installer stops and tells the user to upgrade Codex.
• Nested Codex calls now disable hooks.
• Docs and tests now use the new hooks name.
• The full test runner keeps the signal-heavy monitor runtime suite serial so the parallel suite stays stable.

Reference:

• openai/codex@0d9a5d2
  • Upstream Codex commit that aliases codex_hooks as hooks.

Verification:

• bash -n scripts/install-codex-hooks.sh scripts/bitlesson-select.sh hooks/loop-codex-stop-hook.sh tests/test-codex-hook-install.sh tests/test-disable-nested-codex-hooks.sh tests/test-bitlesson-select-routing.sh tests/test-monitor-runtime.sh tests/run-all-tests.sh
• bash tests/test-codex-hook-install.sh
• bash tests/test-disable-nested-codex-hooks.sh
• bash tests/test-bitlesson-select-routing.sh
• XDG_CONFIG_HOME=$(mktemp -d) HUMANIZE_TEST_JOBS=4 ./tests/run-all-tests.sh

[VitalyAnkh]

CI is still blocked at GitHub's fork-workflow approval gate (action_required). I cannot approve the run from this account because upstream permissions are read-only.

Once an upstream admin approves the workflow run, I can inspect and fix any real CI failures.

Reference commit: openai/codex@0d9a5d2

[VitalyAnkh]

CI failure on run-all-tests was due to tests/test-templates-comprehensive.sh using echo "$result" | grep -q ... on a large template render under set -o pipefail, which can trip Broken pipe on Ubuntu runners when grep -q exits early.

Fix: switch those checks to here-strings (grep -q ... <<<"$result") so the test no longer depends on a SIGPIPE-prone pipeline.

Local verification after the fix:

• bash tests/test-templates-comprehensive.sh
• XDG_CONFIG_HOME=$(mktemp -d) HUMANIZE_TEST_JOBS=4 ./tests/run-all-tests.sh

Reference commit:

• openai/codex@0d9a5d2