[codex] Handle spaces in pre-commit secret scan

[yibeichan]

Summary

• scan staged filenames with NUL-delimited git output and xargs -0
• keep canonical hook templates in hooks/ and cli/schist/sync.py in sync
• bump hook template version to v3 so doctor can flag stale installed hooks
• add regression coverage for a staged secret in a filename containing spaces

Root cause

The pre-commit hook piped newline-delimited staged paths through xargs without -0. xargs split filenames on whitespace, grep skipped the resulting nonexistent path fragments with stderr suppressed, and staged files with spaces could bypass secret scanning silently.

Validation

• cd cli && uv run --with pytest --with . python -m pytest tests/test_pre_commit_hook.py
• cd cli && uv run --with pytest --with . python -m pytest tests/

Closes #202