feat(annotate): replace --silent-approve with --hook

[backnotprop]

Summary

• Replaces --silent-approve with --hook, which emits hook-native JSON that works directly with Claude Code and Codex PostToolUse/Stop hook protocols
• --hook implies --gate (always three-button UX) and supersedes --json if both are passed
• No wrapper script needed: plannotator annotate "$FILE" --hook is a drop-in hook command

Why

After shipping #606, we discovered that --silent-approve solves a problem that doesn't exist:

• Claude Code PostToolUse: plain text stdout is added to transcript as context, it does NOT block. Only {"decision":"block","reason":"..."} blocks.
• Codex PostToolUse: plain text stdout is ignored entirely. Only JSON is processed.
• Claude Code Stop: plain text stdout goes to debug log, NOT added to context. Only {"decision":"block","reason":"..."} prevents stopping.

Stdout matrix

Flags	Approve	Close	Annotate
--gate	The user approved.	empty	feedback (plaintext)
--json	n/a	{"decision":"dismissed"}	{"decision":"annotated","feedback":"..."}
--gate --json	{"decision":"approved"}	{"decision":"dismissed"}	{"decision":"annotated","feedback":"..."}
--hook	empty	empty	{"decision":"block","reason":"..."}

Hook recipe

{
  "hooks": {
    "PostToolUse": [{
      "matcher": "Write",
      "hooks": [{
        "type": "command",
        "command": "plannotator annotate \"$CLAUDE_TOOL_INPUT_file_path\" --hook",
        "timeout": 345600
      }]
    }]
  }
}

Follow-up to #606. Refs #570.

Test plan

• bun test packages/shared/ apps/opencode-plugin/ apps/hook/server/ — 205 pass
• grep -rn "silent.approve\|silentApprove" apps/ packages/ — zero results
• Manual: plannotator annotate README.md --hook → 3-button UX → Approve → empty stdout → Annotate → {"decision":"block","reason":"..."} on stdout