engrim 1.2.2 — setup proves the hooks run instead of assuming it

Every hook engrim wires ends in || true, so a bad hook can never break a Claude Code session. The cost of that safety was silence: a completely non-functional install still printed a full column of green checkmarks. That is how the Windows breakage went unnoticed until someone installed fresh and watched nothing happen.

setup now earns its checkmarks. It runs the binary it just wired, through bash, the way Claude Code will — it was the shell quoting that broke, not the binary, so checking it any other way proves nothing. On failure it prints the reason up front, still writes the hooks (a fixed PATH shouldn't also mean re-wiring by hand), and exits non-zero with the failure as its last word.

That last word needed an explicit stdout flush to actually be last. sys.exit writes to unbuffered stderr while the checkmarks go to a stdout that is block-buffered whenever it isn't a terminal — so under a pipe the verdict printed above the checkmarks it was contradicting. Found by piping the failure path, not by reading it.

_git_root now stops at $HOME instead of climbing past it. Climbing made the project tag depend on whatever happened to sit in /home or C:\Users on that particular machine. A repo above $HOME no longer resolves and falls back to the raw cwd tag: coarser, but deterministic everywhere. The home comparison is normcase'd too, or the guard fails open on Windows, where C:\Users\Tim and c:/users/tim are one directory.

settings.json read errors are honest. A permission error or a decode failure under a legacy locale no longer gets reported as invalid JSON, sending you off to fix a file that was never broken.

Verified on Windows, macOS and Linux (Python 3.10–3.13), and by an external tester on a fresh Windows 11 install.