fix(hooks): pass expectedEventName so a mismatched hookSpecificOutput block is discarded

Wire the bridges to the codec's new discriminator check (merged down from
dsh-hook-protocol): each bridge passes its firing `point` as `expectedEventName`
to runHook, so a hook whose `hookSpecificOutput.hookEventName` names a different
event has its event-scoped fields discarded. Bridge-level guard test: a
PreToolUse hook emitting a UserPromptSubmit-labeled deny no longer denies the
tool (proven red without the wiring, then reverted).

packages/hooks/hooks-codex/src/index.ts

@@ -107,6 +107,8 @@ export function apply(ctx: Context, config: Config): void {
           ...opts.signal ? { signal: opts.signal } : {},
           defaultTimeoutMs,
           trailingNewline: false, // Codex writes stdin WITHOUT a trailing newline.
+          // Discard a `hookSpecificOutput` block naming a different event.
+          expectedEventName: point,
         }, () => performance.now())
         // Codex's SessionStart/UserPromptSubmit treat a clean hook's PLAIN
         // (non-JSON) stdout as additionalContext. The codec keeps that raw text on