feat(TASK-038): add hooks builtin-asset category with example scripts and roles mixin scanning

- AssetCategory::Hooks + InstallFilter::Hooks (NAMES/parse/clap), reserving
  the 'hooks' bundle name via the existing AssetCategory::parse check
- HookAssets embed + install_builtin_hooks(force): installs the bundled
  example scripts 0755 into paths::hooks_dir() via write_file_atomic, wired
  into install_builtins() and install_assets(); warns once when
  COYOTE_HOOKS_DIR diverges from the config-dir default
- assets/hooks/notify.sh: notify-send -> osascript -> terminal fallback,
  with AppleScript-literal sanitization of model-influenced values
- assets/hooks/log-events.sh: appends a COYOTE_* env snapshot (secrets
  excluded, 0600 log, symlink-refusing) to ${COYOTE_HOOK_LOG:-/tmp/coyote-hooks.log}
- sbx-mixin discovery now scans roles/*.sbx-mixin.yaml and
  roles/hooks/*.sbx-mixin.yaml (mirroring the role-hook cwd)
- tests: install+0755+force, install_assets(Hooks) end-to-end, discover()
  roles scanning, reserved bundle name, no-ARGC-BUILD embed content, script
  content order + real execution (secret exclusion, tty-less fallback),
  CLI parser round-trips; hooks_dir env test made #[serial]

assets/hooks/log-events.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Event-logging hook: appends a timestamped snapshot of every COYOTE_* env var
+# to a log file, so you can see exactly which events fire and what context
+# each one carries.
+#
+# Env vars read:
+#   COYOTE_HOOK_LOG   log file to append to (default: /tmp/coyote-hooks.log)
+#   COYOTE_*          everything coyote sets for the event is dumped verbatim
+#
+# Secrets (COYOTE_SECRET_*) are excluded from the snapshot; widening the grep
+# filter below opts into logging them.
+#
+# Wire it up under `hooks:` in your config.yaml (any event works):
+#   hooks:
+#     tool.completed:
+#       - name: log-events
+#         command: ./hooks/log-events.sh
+#
+# A relative command path like ./hooks/log-events.sh resolves against the
+# coyote config directory for global hooks, so this works with the default
+# hooks dir.
+#
+# See https://github.com/Dark-Alex-17/coyote/wiki/Hooks for the full list of
+# events and env vars. Hooks are fire-and-forget: this script never fails
+# loudly, and coyote ignores its exit code either way.
+
+set -u
+
+log_file="${COYOTE_HOOK_LOG:-/tmp/coyote-hooks.log}"
+
+# The default lives in shared /tmp: refuse to append through a symlink someone
+# else planted there. Point COYOTE_HOOK_LOG at a private path to avoid the
+# shared directory entirely.
+[ -L "$log_file" ] && exit 0
+umask 077
+{
+  echo "=== $(date '+%Y-%m-%dT%H:%M:%S%z') ${COYOTE_EVENT:-unknown}"
+  env | grep '^COYOTE_' | grep -v '^COYOTE_SECRET_' | sort
+  echo
+} >> "$log_file" 2> /dev/null || true