[codex] Fix Codex Windows hook fallback

[peyton-alt]

https://entire.io/gh/entireio/cli/trails/684

Summary

• Add Windows-native guarded production hook wrappers that avoid sh -c while preserving the missing-entire PATH guard.
• Switch Codex Windows fallback installs to those guarded cmd.exe wrappers when the existing shell wrapper probe fails.
• Replace stale managed Codex hook commands during command-form migration instead of appending duplicate hooks.
• Clean up branch artifacts: remove stale .gitignore conflict markers and delete stray t1.txt.

Why

A Windows user had Codex hooks fail with exit code 1 when hooks were enabled and entire was installed, because the long sh -c production hook wrapper was not usable in that environment. The targeted fallback keeps the normal wrapper behavior for unaffected installs, but uses a Windows-compatible guarded wrapper when the probe detects the shell wrapper path is broken.

Validation

• mise run check
• mise run lint
• go test ./cmd/entire/cli/agent/... -count=1
• git diff --check origin/main
• entire review --profile codex-temp --base origin/main --agent codex returned approve - no actionable defects found.

---

Note

Medium Risk
Changes how production hook commands are written and recognized on Windows; mis-detection could break Codex hooks or leave duplicate/stale entries, though scope is limited to Codex install paths and shared wrapper helpers with tests.

Overview
Fixes Codex production hook installs on Windows where long sh -c wrappers fail in native shells, while keeping the existing Unix-style wrappers when a runtime probe shows sh -c still works.

Adds cmd.exe / where.exe production wrappers in the shared agent hook helpers (silent exit and JSON/plain missing-entire warnings with CMD escaping), and extends IsManagedHookCommand so uninstall/managed-hook detection recognizes those Windows wrapper forms.

Codex InstallHooks picks Windows vs shell wrappers on Windows production installs based on the probe, and syncHookCommand replaces stale Entire hook entries when the desired command string changes instead of leaving duplicates.

^{Reviewed by Cursor Bugbot for commit c713d66. Configure here.}

[Copilot]

Pull request overview

This PR fixes Codex hook installation on Windows by introducing Windows-native production hook wrappers (avoiding sh -c), switching Codex to those wrappers when a compatibility probe indicates the shell wrapper path is broken, and ensuring hook installs replace stale managed commands instead of accumulating duplicates.

Changes:

• Added cmd.exe/where.exe-guarded production hook wrappers (silent + JSON/plain warning) and extended managed-hook detection to recognize them.
• Updated Codex hook installation to choose Windows wrappers on Windows when the compatibility probe fails, and to replace stale managed hook commands rather than appending duplicates.
• Added/expanded tests around the new Windows wrappers, managed-hook detection, and Codex install migration behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
cmd/entire/cli/agent/hook_command.go	Adds Windows-native production hook wrappers + managed-hook detection updates + CMD escaping helper.
cmd/entire/cli/agent/hook_command_test.go	Adds unit tests for Windows wrappers and managed-hook detection.
cmd/entire/cli/agent/codex/hooks.go	Adds Windows wrapper compatibility probing and hook-command sync (replace vs append) for Codex installs.
cmd/entire/cli/agent/codex/hooks_test.go	Adds tests for Windows probe success/failure paths and migration behavior.