refactor(pack): extract shared hook-bootstrap (stdin, pause, manifest load)

[LanNguyenSi]

What

The claude and codex pack hooks each reimplemented the same init boilerplate (stdin read, pause-sentinel check + announcement, manifest load with injection). That drift was already real — hook-runtime-reality once omitted the pause check entirely (M1). This extracts the three pieces into src/cli/pack/hook-bootstrap.ts (readStdin, checkHookPause, loadManifestOrInjected) and routes every hook through it.

Pure refactor — behavior-preserving (verified)

• checkHookPause forwards all opts to checkPauseFromLoader, which already treats explicit undefined identically to an absent field (!== undefined / ?? {}), so each hook's prior conditional opts-building is byte-identical. All 9 hookLabels and per-hook generatedDir/now/loaderOpts forwarding preserved.
• loadManifestOrInjected keeps the if-injected / else loadManifest pattern and the manifestPath mapping; each hook keeps its own try/catch + error envelope (allow/block/note).
• Legitimate exceptions left local: hook-runtime-reality keeps its isTTY/async-iteration reader; writeguard & stay-in-scope load no manifest; codex-stop & codex-user-prompt-submit have no pause check.

11 hooks migrated; per-hook decision logic untouched.

Tests / verification

• New 10-test unit suite tests/cli/pack-hook-bootstrap.test.ts (incl. a loaderOpts passthrough case locking the loader-derived generated-dir resolution).
• Full suite 2531 passed / 1 skipped; tsc build + typecheck clean.
• Reviewer subagent: APPROVE — traced every hook against the two underlying contracts and confirmed a true no-op. Addressed its findings: added the loaderOpts passthrough test (MINOR) + a comment that the helper narrows on undefined only (NIT).

Scope: only src/cli/pack/* + the new test. No gate decision/envelope/exit-code touched.

Refs: task 6cba4ff9