fix(notepad-guard): refuse Write tool for .sisyphus/notepads files (#3685)

Adds a new `notepad-write-guard` hook that intercepts Write tool calls
whose target path matches `**/.sisyphus/notepads/**` and throws an
actionable error instead of allowing the write to proceed.

Without this guard, an agent that hits an Edit hash-mismatch failure
could silently fall back to Write, destroying the entire history of an
append-only notepad file (decisions.md, issues.md, etc.).  The file
carries an explicit "NEVER overwrite" warning that the agent ignores
under context pressure.

The guard is path-based so it works regardless of plan name or nesting
depth.  Non-notepad `.sisyphus/**` paths (e.g. plan files) are
unaffected.  The hook is wired into `create-tool-guard-hooks` under the
hook name `notepad-write-guard` and follows the same safeCreateHook +
HookName schema pattern as every other tool-guard hook.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/config/schema/hooks.ts

@@ -49,6 +49,7 @@ export const HookNameSchema = z.enum([
   "tasks-todowrite-disabler",
   "runtime-fallback",
   "write-existing-file-guard",
+  "notepad-write-guard",
   "bash-file-read-guard",
   "anthropic-effort",
   "hashline-read-enhancer",