Why

Hook trust happens through the TUI in /hooks so it can block non-interactive use cases. This flag will allow users that are using codex headlessly to bypass hooks when they want to.

What

This adds one invocation-scoped escape hatch.

• the CLI flag sets a runtime-only bypass_hook_trust override; there is no durable config.toml setting
• hook discovery still respects normal enablement, so explicitly disabled hooks remain disabled
• we show a --dangerously-bypass-hook-trust is enabled. Enabled hooks may run without review for this invocation. message on startup so accidental use is visible in both interactive and exec flows

This keeps “enabled” and “trusted” as separate concepts in the normal path, while giving CI/E2E callers a stable way to opt into the exceptional path when they already control the hook set.