fix: verify the active Notes hook chain

[johnson-ricon]

Finding

PR #191's new required-hook check can approve a hook chain that Git will not execute.

Two disposable reproductions committed notes/alpha.md as a readable path after notes stage succeeded:

• core.hooksPath pointed at .githooks, while Notes installed and inspected inactive .git/hooks;
• an executable pre-commit only mentioned pre-commit.d in a comment and exited zero without running any fragments.

Both cases bypass the fail-closed staging invariant from #152.

Fix

• resolve Git's active hook directory through git rev-parse --git-path hooks;
• install every dispatcher and fragment into that active directory;
• require the installed dispatcher to match Notes' current dispatcher exactly;
• replace stale or non-dispatching copies during notes install-hooks --yes;
• cover refusal before index mutation, repair, and a successful opaque-name commit cycle.

Validation

• mise run test stage (27 tests)
• mise run test obfuscation-hooks (24 tests)
• mise run test encrypt (25 tests)
• mise run test commit (13 tests)
• mise run test integration (32 tests, 3 environment skips)
• both disposable bypass reproductions now refuse before index mutation
• all 8 configured Codebase lints
• mise run doctor
• readme build --check
• bash -n lib/hooks.sh
• git diff --check

A complete local suite attempt reached test 173/451 without an assertion failure before the 600-second harness limit; exact PR #191 hosted macOS and Ubuntu checks were green before this branch was created.