Fail closed when staging readable notes without installed hooks

[junior-ricon]

Problem

In a fresh notes-managed clone with readable notes unlocked but repository hooks not installed, notes stage can stage readable plaintext paths and a normal git commit can commit them successfully.

This makes the encryption invariant depend on an out-of-band hook being present. The staging command does not detect that its required obfuscation/guard hook is absent, and notes unlock ends by suggesting staging/commit commands without warning about the missing protection.

Observed with selected shiv:notes@0.8.19 while making a Fold documentation change.

Reproduction

From a fresh authenticated clone of ricon-family/fold:

mise trust
notes unlock
# Deliberately do not run notes install-hooks or repo agent:prepare.

# Edit two existing readable managed notes.
notes stage fresh-agent-home-desk-guide.md local-agent-wakes.md
git add <ordinary non-note files>
git commit -S -m 'example'

git show --name-status HEAD

Observed commit entries:

A  notes/fresh-agent-home-desk-guide.md
A  notes/local-agent-wakes.md

The commit succeeded because the fresh clone had no notes pre-commit dispatcher. Nothing was pushed. Resetting the local commit, running notes install-hooks --yes, and recommitting correctly produced modifications to obfuscated IDs instead:

M  notes/c53f4c61
M  notes/dcf20fcf

The committed manifest remained encrypted after the corrected path.

Expected

A notes-owned command should fail closed when its safety contract is unavailable.

At minimum, notes stage should detect that the required hook/dispatcher is absent or stale and refuse with a direct recovery command. A stronger design could make staging perform the obfuscation itself so correctness does not depend on a later Git hook.

notes unlock should also visibly report missing hook protection before printing instructions that invite staging or committing.

Why this belongs in notes

Home and repo agent:prepare already install hooks on the supported prepared path. This incident occurred in an isolated scratch clone where that preparation step was skipped. Better preparation guidance is useful, but the tool should still prevent a plaintext commit when called directly in a plausible fresh-clone sequence.

Related umbrella: #129. Related historical manifest protection: #77.

Done when

• a regression test reproduces unlocked managed notes with absent hooks;
• notes stage cannot lead to a successful plaintext readable-note commit in that state;
• the recovery path names notes install-hooks --yes or an equivalent safe setup command; and
• unlock/status/doctor UX makes missing hook protection visible.