[Hooks] Add opt-in fail-closed handling for PreToolUse hook failures

What variant of Codex are you using?

Codex CLI and app-server. The behavior was characterized against rust-v0.148.0 at commit 3ba0f711642a888aec92a611a3f3b2211157ff89.

What feature would you like to see?

Add an opt-in fail-closed policy for PreToolUse command hooks, parallel to the UserPromptSubmit proposal in #33630.

Today a PreToolUse hook can block through a valid exit-2 or permissionDecision: "deny" result, but a timeout, spawn failure, crash/non-protocol exit, or malformed output is treated as a failed hook with should_block=false, so the tool is dispatched. That makes a policy hook least reliable precisely when its process is unavailable.

A narrow configuration shape could be:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "",
        "failureMode": "block",
        "hooks": [
          {
            "type": "command",
            "command": "path/to/local-policy-hook"
          }
        ]
      }
    ]
  }
}

Requested semantics:

• failureMode accepts continue or block.
• Omitted or continue preserves the existing behavior.
• block prevents tool dispatch when the hook times out, cannot be spawned, crashes or exits without a valid protocol result, emits malformed output, or encounters event-serialization failure.
• The user receives a redacted blocking diagnostic that contains no command, tool-input, or hook-payload values.
• The setting participates in hook trust/config hashing, and effective-config reads expose the resolved value to app-server/Desktop consumers.
• Tests prove every failure class blocks before tool execution while valid allow and deny results remain unchanged.

This is the PreToolUse counterpart to #33630; it does not require changing the compatibility default for advisory hooks.

Start by tracing the PreToolUse hook path in the Codex CLI and app-server, then compare the proposed behavior with #33630. Done means an opt-in failureMode is represented in trust/config hashing and effective-config reads, blocks every listed failure before tool execution with redacted diagnostics, and preserves valid allow and deny results; tests should cover each failure class.