fix(core): protect every file Memnox installs a hook into

[Cedric921]

Closes #27.

What this changes

Memnox installs its policy hook into five files. It protected one. Measured on main:

.codex/hooks.json                protected=no   named=no
.cursor/hooks.json               protected=no   named=no
.gemini/settings.json            protected=no   named=no
.codeium/windsurf/hooks.json     protected=no   named=no
.claude/settings.json            protected=yes  named=yes

So Cursor could edit ~/.cursor/hooks.json, drop the policy hook, and self-protection.ts would not refuse it — the agent removing its own guardrail, which is the one thing the module exists to stop. Same for Codex, Gemini CLI and Windsurf. With the change all five read yes.

How it stays fixed

AGENT_HOOK_FILES is one list in gate/protected-paths.ts, exported from @memnox/core. The installer in cli/src/protect/agent-hooks.ts builds its four paths from it, isProtectedPath matches against it, and NAMES_PROTECTED is now built from it rather than spelled out again. That is the shape the issue asks for: a file gaining a hook cannot be left unguarded, because the installer and the guard read the same line.

It is segments rather than a joined string so the installer keeps using join() and stays right on Windows, while the guard compares the posix spelling it already normalises to.

How it was verified

Four shell lines, one per agent, each refused — sed -i, rm, echo >, cp — and a table test asserting both isProtectedPath and namesProtected for every entry in the shared list, so a future entry is covered the moment it is added.

Two negatives pin that this did not widen into the directories: ~/.cursor/rules.json and ~/.codex/notes.json are still a person's ordinary files.

Test Files  286 passed (286)
     Tests  8461 passed (8461)

prettier, tsc, vitest and knip all clean, on Node 24.

What I did not do

The issue also mentions intercept/os-guard.ts. The kernel profile is a separate list with its own shape, and the acceptance criteria stop at the gate, so I left it alone rather than guess at the seatbelt and Landlock wording. Worth its own issue if the four should be walled there too — happy to take it.

Checklist

• pnpm format && pnpm typecheck && pnpm test && pnpm deadcode all pass
• Behaviour change ships with a test
• No any, no magic values, no console.* outside cli-output.ts
• If this touches the decision path: still deterministic — one more path list, no model, network or randomness
• If this changes a verb table: n/a
• If this changes a command, flag or file it writes: it writes nothing new; four more paths are refused to an agent, which the changeset names