refactor(hooks): tighten the hook-protocol contract surface

Implement the tighten-hook-protocol-contract RFC (moved to implemented/):

- HookDialect narrows to 'claude' | 'codex': the 'native' variant had zero
  producers (native plugins on the seams write no hook/* provenance), and the
  dialect is defined as the bridge that ran the hook.
- HookOutput.suppressOutput is gone: the codec parsed it and every path
  discarded it with no warn and no deferral — hook stdout never enters a
  transcript, so there is nothing to suppress.
- hook/result.durationMs is gone: durable timing telemetry with no reader
  that the snapshot normalizer had to scrub as replay noise. With no duration
  to measure, runHook loses its injected now clock and the single-field
  RunHookResult wrapper — it returns the HookOutput directly. The committed
  hook fixtures had the field stripped mechanically (field-only diff); the
  stdout goldens never carried it.
- The bridges' double-defaulted defaultTimeoutMs config knob is replaced by
  one reference-default constant, DEFAULT_HOOK_TIMEOUT_MS, exported from the
  lib's runner and applied inside runHook; per-hook timeoutSec stays the
  override surface.
- The hook/result semantics move into the lib that declares the event:
  HookResultRecord now carries the decoded HookOutput and appendHookResult
  derives the decision string (decision ?? stop-on-continue:false ?? pass)
  and the 500-char stderrSummary truncation; both bridges delete their
  byte-identical private copies. The snapshot suite passes against the
  existing goldens, proving the derived values are unchanged.
- Rider: BLOCKING_EXIT_CODE is codec-internal again (zero importers).

Amend the hook-protocol-lib and hook-snapshot-matrix RFCs to the new facts,
update the lib/bridge READMEs and the session.md event tables, and retarget
the affected unit tests (including new lib-level coverage of the derivation
rules).

packages/hooks/hook-protocol/src/index.ts

@@ -12,7 +12,9 @@
  * - {@link mergeHookOutputs} — fold multiple matched hooks into one
  *   most-restrictive {@link MergedHookOutcome} (deny > ask > allow).
  * - {@link appendHookInvoked} / {@link appendHookResult} — the log-only `hook/*`
- *   session-event helpers (declaration-merged into `SessionEventMap`).
+ *   session-event helpers (declaration-merged into `SessionEventMap`);
+ *   `appendHookResult` derives the durable `decision`/`stderrSummary` from the
+ *   {@link HookOutput} so the shared event's semantics live in one place.
  *
  * Each bridge owns what genuinely DIFFERS: building the per-event stdin payload
  * (CC vs Codex field sets), the dialect's env/substitution, and mapping the
@@ -29,9 +31,9 @@ export type {
   MatcherMode,
 } from './types.ts'
 export { matchesMatcher } from './matcher.ts'
-export { BLOCKING_EXIT_CODE, parseHookOutput } from './codec.ts'
-export { runHook } from './runner.ts'
-export type { RunHookOptions, RunHookResult } from './runner.ts'
+export { parseHookOutput } from './codec.ts'
+export { DEFAULT_HOOK_TIMEOUT_MS, runHook } from './runner.ts'
+export type { RunHookOptions } from './runner.ts'
 export { mergeHookOutputs } from './merge.ts'
 export type { MergedDecision, MergedHookOutcome } from './merge.ts'
 export { appendHookInvoked, appendHookResult } from './events.ts'