feat: Wave C — fail-closed PostToolUse validate hook (0.7.1)

[RichardHightower]

Tickets

• Closes #58 — Wave C: Codex fail-closed PostToolUse validate hook
• Implements part of #55 — master plan

What landed

1. hooks/hooks.json matcher is now apply_patch|Write|Edit|MultiEdit
2. scripts/okf-curate.sh no longer swallows validate's exit code (|| true / exit 0 removed)
3. Hook parses Claude tool_input.file_path and Codex apply_patch patch text
4. Silent exit 0 when the write is not inside an OKF bundle
5. Tests: existing 5 cases plus fail-closed invalid bundle, apply_patch payload, and no SessionStart in the manifest
6. Version 0.7.1

Design

• Validate is the gate. This is not a second curator that rewrites the tree after a raw Write.
• No SessionStart reminder. No com.openai.codex/ layout. No MCP. No cascade to job packs.

Privacy fence

• Actors: claude-code/lumenfield-detector, grok-bot/northstar-console only.
• No private remote URLs or real client names.

Review

Human OK before merge. #55 stays open until whole-plan acceptance (this is C2 / okf-plugin only).