maintainer: PreToolUse-hook-enforced house rules (deny even under bypassPermissions)

[JSONbored]

When the miner's CodingAgentDriver runs a coding agent (e.g. Claude Agent SDK) that itself has arbitrary tool-use ability, prompt-level instructions alone are not a safety boundary — a coding agent can be steered around them, and a bypassPermissions-configured session ignores interactive approval prompts entirely. This issue builds a PreToolUse-hook-enforced denial layer that runs OUTSIDE the coding agent's own reasoning, so house rules (no secrets in diffs, no writes outside the target repo's worktree, no execution of the Governor's OWN write specs without going through the chokepoint) hold even when the underlying agent session has bypassPermissions set.

This was flagged in the roadmap to be "pulled forward from Phase 0/3 if not already started there" — check for any existing scaffold before starting; if none exists, this issue builds it from scratch. Maintainer-owned: this is a hard security boundary, not a bookkeeping task.

Deliverables

• A PreToolUse hook registered against the CodingAgentDriver's underlying session that intercepts every tool call BEFORE execution
• The hook denies (not just warns) any tool call matching a configured house-rule denylist, and this denial is enforced identically whether or not the session was started with bypassPermissions
• House rules are sourced from a single, auditable list (not scattered inline checks) so they can be reviewed as one unit
• Tests: a denied tool call is blocked under normal permission mode AND under bypassPermissions, an allowed tool call passes through unmodified, and a hook-internal error fails closed (denies) rather than silently allowing
• Every denial is recorded to the governor ledger with the specific rule that fired

References

• src/selfhost/ai.ts + src/selfhost/ai-config.ts — the existing SelfHostAi/AI_PROVIDER seam this driver mirrors (cited as the template for the whole CodingAgentDriver seam)
• The Governor chokepoint + append-only ledger (companion maintainer/foundation issues) — this hook's denials feed the same ledger
• Check packages/gittensory-miner/ for any Phase-0-scaffolded hook config before starting; if absent, this issue is the first implementation

[linear-code]

JSO-2440