Add workspace lifecycle hooks

[VincentShipsIt]

PRD: workspace-lifecycle-hooks

Executive Summary

Adopt Symphony's four-hook workspace lifecycle. Target repos can declare `after_create`, `before_run`, `after_run`, `before_remove` shell scripts in WORKFLOW.md front matter. `WorktreeManager` and the pipeline runner invoke them at the matching lifecycle points. Removes the need for users to manually `bun install` or set env per worktree.

Implementation Checklist

• `WorktreeManager` invokes `after_create` exactly when a new directory is created (not on reuse)
• Pipeline runner invokes `before_run` before each agent attempt; non-zero exit aborts the attempt with a structured error
• Pipeline runner invokes `after_run` after each attempt; failure logged as warning only
• `WorktreeManager.remove` invokes `before_remove` if the directory still exists; failure logged only
• All hooks executed via `bash -lc` with the worktree path as cwd

Problem Statement

Worktrees are created blank from origin. Today the agent must spend turns on `bun install`, `mise install`, env setup, etc. — wasted tokens and brittle. There is no out-of-band setup hook.

Related: #41 (worktree setup contract). This PRD is the runtime executor.

Goals

• After-create hook runs once per new worktree.
• Before-run hook runs before every agent attempt; failure aborts the attempt.
• After-run hook runs after every attempt regardless of outcome; failure logged and ignored.
• Before-remove hook runs before worktree deletion; failure logged and ignored.
• All hooks share `hooks.timeout_ms` (default 60000).

Non-Goals

• Hook script discovery from a path other than WORKFLOW.md front matter.
• Sandboxing the hook beyond the worktree cwd (it remains arbitrary shell).
• Replacing the agent's own setup turns when no hook is configured.

User Stories

• As a target-repo maintainer with an `after_create` hook of `bun install`, I want the worktree provisioned before the agent runs, so the planner does not waste turns on dependency setup.
  Acceptance:
  • On first creation, `bun install` runs before any agent spawns.
  • On subsequent re-runs of the same worktree, after_create does not re-fire.
  • Hook stdout/stderr is captured and surfaced to the IPC error stream truncated.

Functional Requirements

1. `WorktreeManager` invokes `after_create` exactly when a new directory is created (not on reuse).
2. Pipeline runner invokes `before_run` before each agent attempt; non-zero exit aborts the attempt with a structured error.
3. Pipeline runner invokes `after_run` after each attempt; failure logged as warning only.
4. `WorktreeManager.remove` invokes `before_remove` if the directory still exists; failure logged only.
5. All hooks executed via `bash -lc` with the worktree path as cwd.
6. Per-hook timeout enforced; timeout treated as failure for that hook.

Non-Functional Requirements

• Hook stdout/stderr truncated to 10KB in IPC; full output written to the main-process console.
• Hook secrets must not appear in user-visible logs; honor existing env-filtering rules.

Success Criteria

• Unit tests: each hook fires at the right lifecycle point on first attempt.
• Reuse test: `after_create` does not re-fire on second-run of same worktree.
• Failure semantics test: `before_run` failure aborts attempt; `after_run` failure does not.
• Timeout test: hook exceeding `hooks.timeout_ms` is killed and treated as failure.

Out of Scope

• Hook content; this is repo-owned.
• WORKFLOW.md loader (Add WORKFLOW.md target-repo policy #65).
• Hot-reload of hook strings (Hot-reload WORKFLOW.md changes #71).

Dependencies

• Add WORKFLOW.md target-repo policy #65 (config source).
• `packages/git/src/worktree.ts` — invocation point for create/remove hooks.
• Pipeline runner phase boundaries in `packages/pipeline/src/pipeline.ts`.
• Symphony spec: https://github.com/openai/symphony/blob/main/SPEC.md#94-workspace-hooks

Verification Plan

• tests: `packages/git/src/worktree.test.ts` extended with hook firing/failure cases; new `packages/pipeline/src/hook-runner.test.ts` for before_run/after_run wiring.
• manual: target repo with `after_create: echo created > /tmp/hook.log`; run pipeline; verify file appears once and not on rerun.

Risks & Open Questions

• Hook scripts can do anything in the workspace; we treat WORKFLOW.md as fully trusted config (Symphony §15.4).
• Long-running `after_create` (e.g. `bun install` 30s+) — confirm default 60s timeout is sufficient or document tuning.
• Interaction with existing project-setup logic in `packages/agents/src/project-setup.ts` — coexist or supersede?