feat(hook): Windows hook-decide over named pipe — enforce works on Windows (#162)

[Ju571nK]

What

Implements the Windows hook-decide IPC so sigil-hook --enforce actually blocks on Windows. Previously it was a silent no-op (#162): the daemon started no decide listener on Windows and the hook client was a #[cfg(not(unix))] stub returning None, so every tool call fail-opened regardless of hook_deny_rules — false assurance for Windows users.

Changes

• hook_event (new, cross-platform module): to_event + enum_str extracted from hook_listener so the decide path can convert events without compiling the Unix-socket listener.
• Daemon (hook_decide_listener): per-connection logic factored into a transport-generic handle_decide_conn<S: AsyncRead + AsyncWrite>. The Unix-socket serve keeps its behavior; a new #[cfg(windows)] serve_pipe listens on a named pipe, mirroring the control plane's named-pipe server. Spawned from runtime under #[cfg(windows)] on the same shared, hot-reloadable evaluator. Windows pipes carry no peer uid → u32::MAX. hook_listener returns to #[cfg(unix)].
• Hook (decide.rs): the #[cfg(not(unix))] request_verdict is now a real client — opens the named pipe as a blocking file (the hook is a short-lived, no-tokio process) on a worker thread bounded by the deadline via recv_timeout; any failure/timeout → None (unchanged fail-to-on_failure contract). Default pipe: \\.\pipe\sigil-hook-decide.

Verification

Cannot cross-compile Windows locally (sqlite C dep), so the Windows side was built and run on a real Windows 11 ARM64 VM:

• cargo build + cargo clippy -D warnings for sigil-agent/sigil-hook — both exit 0.
• Runtime, freshly-built binary, with a block-rm-rf deny pack in C:\ProgramData\Sigil\rule-packs.yaml:
  • boot log now shows hook-decide IPC listening pipe=\\.\pipe\sigil-hook-decide (absent before).
  • sigil-hook claude-code --enforce on rm -rf … → permissionDecision: deny ("Blocked by Sigil rule block-rm-rf").
  • ls → allow (silent).
• Unix unchanged: hook_event tests + hook_listener drift test + decide listener enforce_e2e green; fmt/clippy -D warnings/tests clean.

Notes / follow-ups

• The Windows decide pipe uses the default named-pipe ACL (the Unix socket uses 0660). Verdicts are non-sensitive (allow/deny for a submitted action, no mutation, semaphore-bounded), but tightening the pipe ACL to the owning user could be a hardening follow-up.
• This PR also carries a docs comparison image committed to the branch in a parallel session.

Closes #162

🤖 Generated with Claude Code