feat: harden Python gr2 hook runtime semantics

[laynepenney]

The hook config model is designed, but the Python runtime still needs the full semantics enforced consistently in the real CLI.

Scope:

• enforce if_exists = skip|overwrite|merge|error for file projections
• enforce on_failure = block|warn|skip across materialize/enter/exit
• make when = first_materialize|always|dirty|manual concrete in the runtime
• keep behavior machine-readable and predictable

Why:

• Python gr2 is now the UX authority
• hook behavior is part of the product contract, not just a prototype detail
• current partial behavior is enough to demo, not enough to trust daily

Acceptance:

• hooks behave according to HOOK-CONFIG-MODEL.md
• failure behavior is explicit, testable, and unsurprising
• projection conflicts do not fail silently