[arzafran]

What this does

Reinstalling Programa's Codex hooks no longer fails when another tool (cc-settings) has added its own hook groups after Programa's in the same event. Programa now rewrites its own handler where it already sits instead of deleting it and appending a new one at the end. Other tools' handlers keep their positions, so their Codex trust entries stay valid.

Before, a hooks.json with Programa at group 0 and cc-settings at group 1 (SessionEnd, UserPromptSubmit) failed with "would move foreign handler 0 from 1:0 to 0:0".

Behavior notes:

• Install: the first Programa handler per event is updated in place. A new group is appended only when the event has none. Extra duplicate Programa handlers are still removed, and the existing position guard still refuses if that would shift a foreign handler.
• Uninstall is unchanged and still refuses when removing Programa's group would shift a later foreign group. Allowing it would need the user to re-grant trust in Codex /hooks, which is a separate decision.
• test_install_refuses_to_reassign_a_foreign_positional_trust_key now seeds a duplicate Programa group, since the old [programa, foreign] layout no longer needs a refusal.

Review order

1. tests/test_cli_codex_hook_trust.py (first commit, new test, expected red on CI)
2. CLI/CLI+Hooks.swift codexRewriteHooks (second commit, goes green)

Test plan

• CI step "Run Codex hook trust regression" is red on the first commit and green on the second.
• New test test_reinstall_updates_programa_in_place_when_foreign_groups_follow_it passes.
• Existing trust tests (idempotent reinstall, duplicate-group refusal) still pass.

[arzafran]

Rebased onto #395, which moves enough out of CLI/CLI+Hooks.swift to fit this change under the line budget. The same two commits are on #395's branch, so this PR closes as merged when #395 lands.

[arzafran]

The fix and its test landed on main with #395 (5813207 test, bd03a72 fix). The extra line-budget refactor commit isn't needed anymore: CLI/CLI+Hooks.swift is 3412/3610 on main, and the commit conflicts with it now.