#15936 fix: enforce trusted-before-project ordering for hooks

Summary

• execute trust-sensitive hook events in trust-precedence tiers so non-project hooks run before project hooks for PreToolUse, SessionStart, and UserPromptSubmit
• preserve parallel execution within each trust tier while skipping lower-precedence project hooks once a higher-precedence hook blocks or stops processing
• add regression coverage for prompt/session hook data exposure so project hooks cannot observe those payloads before higher-trust hooks have a chance to stop processing

Security

• closes the PreToolUse race where a project hook could observe or exfiltrate a tool invocation before a higher-precedence non-project hook denied it
• closes the analogous prompt/session leak where project UserPromptSubmit or SessionStart hooks could observe prompt or startup data before a higher-precedence hook stopped processing
• keeps project hook execution aligned with the trust boundary established by #14718, which prevents untrusted project-local hook config from loading before trust is granted

Stack

• Builds on the #14718 trust-gate work now in main
• This PR enforces trust precedence at hook execution time for hook events that can block or stop downstream processing
• Managed hook policy and enterprise lockdown behavior remain covered by the follow-up managed-hooks PR, not this one

Test

• cargo test -p codex-hooks
• cargo test -p codex-hooks higher_precedence_stop_skips_lower_precedence_handlers
• cargo clippy -p codex-hooks --tests -- -D warnings
• just argument-comment-lint -p codex-hooks -- --tests