fix: report from a Codex session on Windows

[omartelo]

A Codex session on Windows failed every hook this plugin registers — hook exited with code 1 on SessionStart, UserPromptSubmit and Stop, plus hook returned invalid stop hook JSON output on top of it. Nothing reached lich, and the errors sat in the user's transcript.

Two causes, both on this side.

The plugin root was spelled the one way Codex does not expand. Codex substitutes ${KEY} and nothing else before handing the line to a shell (discovery.rs):

let command = source.env.iter().fold(command, |command, (key, value)| {
    command.replace(&format!("${{{key}}}"), value)
});

hooks/codex-hooks.json used the bare $CLAUDE_PLUGIN_ROOT. On Unix that survives by accident — hooks go to $SHELL -lc, and the shell expands what Codex left alone. On Windows they go to cmd.exe /C, which does not, so every hook ran a path that does not exist. Fixed by using the braced form, the one hooks/hooks.json has always used.

cmd.exe cannot execute a .sh. Each hook now also registers a commandWindows handing the same script and the same argument to hooks/win-run.cmd, which looks for Git Bash — on PATH, then at its default install — and always exits 0, bash or no bash. Codex picks commandWindows over command on Windows and ignores it everywhere else, so one registration still serves both.

The invalid stop hook JSON output line was the second symptom of the first cause: cmd.exe writes its error to stdout, and Codex reads a Stop hook's stdout as a decision. The wrapper drops output for that reason too.

Nothing about a Unix run changes.

Test plan

• node --test tests/*.test.mjs — 129 pass
• Two new cases: codex-hooks.json may not carry a bare $CLAUDE_PLUGIN_ROOT, and every hook's commandWindows must wrap its command through win-run.cmd

Not in this PR

docs/providers.md still says Codex has no SessionEnd. It has one now — the event is in the current HookEventsToml — so the idle report may already be firing. Left alone until it is verified against a real session.