Fix Codex hook path so .codex-directory installs run the detector

The committed .codex/hooks.json hardcoded .agents/skills/impeccable/scripts/
hook.mjs. On a .codex-directory install the skill payload lives at .codex/
skills/..., so the guarded command ([ ! -f X ] || node X) found no file and
silently no-opped, leaving the design detector dead for those users.

Derive the hook payload path from the emitting provider's own configDir rather
than hardcoding .agents:

- buildCodexHooksManifest(skillDir) now builds `${skillDir}/skills/impeccable/
  scripts/hook.mjs`; hooksJsonFor threads each provider's configDir through. The
  Codex provider (configDir .codex) emits .codex/skills; the root sync and the
  self-consistent dist/codex bundle both point at their own payload.
- CLI installer: project-scope hook rewriting now derives the provider's own
  project-relative path instead of preserving the bundle token. The Codex bundle
  ships a .codex/skills command, but the CLI lays the skill at .agents/skills, so
  the installed .codex/hooks.json is rewritten to .agents/skills (Claude keeps
  its ${CLAUDE_PROJECT_DIR} token; global installs keep the absolute rewrite).

Per-provider hook payload path after the fix:

  Emission                              hook path
  dist/codex/.codex/hooks.json          .codex/skills/impeccable/scripts/hook.mjs
  root .codex/hooks.json (build sync)   .codex/skills/impeccable/scripts/hook.mjs
  CLI .agents (codex) project install   .agents/skills/impeccable/scripts/hook.mjs
  CLI .agents (codex) global install    <home>/.agents/skills/.../hook.mjs (abs)
  .claude / .cursor                     unchanged

Tests: extended hook-build (codex-dir -> .codex/skills, agents-dir -> .agents/
skills) and skills-cli (bundle ships .codex/skills, install rewrites to .agents/
skills). Regenerated tracked .codex/hooks.json via build:release.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cli/bin/commands/skills.mjs

@@ -1179,6 +1179,19 @@ function hookArtifactsForProvider(bundleDir, root, provider) {
   });
 }
 
+// The project-relative hook command path for a provider, used for project-scope
+// installs (skillRoot === root). Derived rather than copied from the bundle: the
+// Codex bundle ships a `.codex/skills/...` command (correct for a `.codex`-
+// directory install), but the CLI lays Codex's skill down at `.agents/skills/`,
+// so preserving the bundle token would point the hook at a nonexistent file and
+// silently no-op it. Claude keeps its ${CLAUDE_PROJECT_DIR} token so a manifest
+// read from a nested cwd (or copied into settings.local.json) still resolves.
+function hookScriptRelPathForProvider(provider) {
+  const script = provider === '.cursor' ? 'hook-before-edit.mjs' : 'hook.mjs';
+  const rel = `${provider}/skills/impeccable/scripts/${script}`;
+  return provider === '.claude' ? '${CLAUDE_PROJECT_DIR}/' + rel : rel;
+}
+
 function hookScriptPathForProvider(skillRoot, provider) {
   // `.github` is intentionally absent: its hook manifest (`.github/hooks/
   // impeccable.json`) is a committed, team-shared file that the Copilot cloud
@@ -1228,9 +1241,10 @@ function rewriteHookCommandsForSkillRoot(value, provider, { skillRoot, absolute
     if (absolute) {
       quotedPath = JSON.stringify(hookScript);
     } else {
-      // Preserve the bundle's own path token (e.g. ${CLAUDE_PROJECT_DIR}/...).
-      const match = value.match(/"([^"]+)"/);
-      quotedPath = match ? JSON.stringify(match[1]) : JSON.stringify(hookScript);
+      // Project-scope install: derive the provider's own project-relative path
+      // rather than trusting the bundle token, which for Codex points at
+      // `.codex/skills/...` while the CLI installs the skill at `.agents/skills/`.
+      quotedPath = JSON.stringify(hookScriptRelPathForProvider(provider));
     }
     return guardHookCommand(quotedPath);
   }