feat: support user-level defaults for companion config (e.g. stopReviewGate)

[bk-squared]

Summary

Currently codex-companion stores config per git-repo root, with no fallback source. Options like stopReviewGate have to be toggled individually for every repo. It would be great to support a user-level defaults file that workspace state can override.

Related

• Feature: support default model and effort settings in /codex:setup #44 — complementary, not duplicate. That issue proposes persisting --model / --effort defaults in the existing per-workspace state. This issue proposes a lower-priority, user-level baseline that applies across all workspaces. If both land, Feature: support default model and effort settings in /codex:setup #44 gives you per-workspace defaults and this gives you cross-workspace ones; they compose cleanly.
• Review gate setup writes to temp dir, but Stop hook reads from persistent dir #59 — adjacent state-resolution bug (setup writes to one state dir, Stop hook reads from another). Not the same problem, but anyone touching resolveStateDir / getConfig will want to read both together.

Scope (explicit)

Per-workspace state always wins. The user-level file is a baseline only — never overrides an explicit per-repo setting. No existing state schema changes.

Current behavior

scripts/lib/workspace.mjs resolves the workspace as the nearest git repo root, and scripts/lib/state.mjs keys state under \$CLAUDE_PLUGIN_DATA/state/<slug>-<sha256(realpath)[:16]>/state.json. getConfig() only reads that per-repo file — there is no lookup of a shared/user-level default. So enabling the review gate across N sibling repos under a shared workspace requires N separate `codex-companion setup --enable-review-gate` invocations.

Use case

I maintain a workspace with many sibling git repos (research / infra / teaching subtrees). I want the stop-time review gate enabled by default everywhere, while still being able to disable it in specific repos that don't need it. Running the setup command repeatedly across every new clone is friction, and easy to forget.

This is the same ergonomic pattern that git (`/.gitconfig` → repo `.git/config`), npm (`/.npmrc` → project), and Claude Code itself (`~/.claude/settings.json` → project `.claude/settings.json`) already provide.

Proposed behavior

Introduce a lower-priority defaults file, e.g. `$CLAUDE_PLUGIN_DATA/defaults.json` (or `~/.config/codex-companion/defaults.json`). `getConfig()` would shallow-merge in this order:

```
built-in defaults < user defaults < per-workspace state
```

The setup command could gain `--global` (or `--user`) to write the defaults file instead of the workspace state:

```
codex-companion setup --enable-review-gate --global
```

Why this feels like a small change

• One new resolver + shallow merge in `lib/state.mjs::getConfig`.
• One new flag branch in the setup command.
• No schema change to existing per-workspace state.

Happy to send a PR if the maintainers are open to this direction — would prefer to confirm the preferred location (`$CLAUDE_PLUGIN_DATA/defaults.json` vs. `$XDG_CONFIG_HOME/...`) before coding.