Setup should merge existing Codex hook config instead of replacing host hooks

[BaseInfinity]

Summary

setup.sh --yes should merge SDLC hook entries into an existing .codex/hooks.json instead of replacing the host repo's hook config. In a real VisualHUD setup pass, a temp probe showed the shell setup path would replace the repo's existing Codex hook wiring with the generic SDLC hook set, which would drop non-SDLC hooks.

Evidence

Context from dogfooding in visualhud:

• The repo already had Codex hooks for VisualHUD terminal state and repo-specific prompt/guard behavior.
• Running the setup path in a temp copy with CODEX_HOME redirected showed .codex/hooks.json would be overwritten by the wizard's generic hook file.
• The safe repair had to be done manually by preserving existing VisualHUD hook commands and appending the SDLC compact-guard.cjs / session-start.cjs entries.
• After that manual merge, npx codex-sdlc-wizard@latest check reported all managed files as match and npx codex-sdlc-wizard@latest update was a no-op.

Why this matters

Consumer repos may already have important Codex hooks before SDLC setup. Replacing .codex/hooks.json can silently disable product/tooling behavior outside the wizard's ownership, such as terminal HUD hooks, repo-local guards, or other agent integrations.

Expected behavior

For setup/update repair:

1. Parse existing .codex/hooks.json.
2. Preserve unrelated existing hook commands.
3. Add or refresh only wizard-owned SDLC hook commands.
4. Prefer universal Node hook entries where appropriate.
5. Record the merged result in the manifest so future $update-wizard runs treat the merge as intentional instead of drift.

Suggested regression

Add a fixture repo with pre-existing UserPromptSubmit, PreToolUse, PostToolUse, SessionStart, PreCompact, and PostCompact commands. Run setup.sh --yes --model-profile maximum or the equivalent package entrypoint and assert:

• Existing non-SDLC commands remain.
• SDLC commands are added once.
• No duplicate commands are introduced on repeated setup/update.
• check reports the resulting hook config as initialized and non-broken.