…x isolation

Users need Source Control commits/pushes on main from VS Code, but Codex/agent sessions must still be forced through agent/* + PR flow.\n\nThis updates pre-commit and pre-push to allow protected-branch writes only for non-Codex VS Code Git context, keeps explicit Codex blocks, and synchronizes installer metadata/tests/docs so pre-push is treated as a managed hook.

Constraint: Preserve existing protected-branch safety guarantees for Codex/agents

Rejected: Global protected-branch bypass | would weaken guardrails outside VS Code context

Confidence: high

Scope-risk: moderate

Reversibility: clean

Directive: Keep template hooks and installed .githooks copies in sync when policy changes

Tested: npm test

Tested: node --check bin/multiagent-safety.js

Tested: npm pack --dry-run