fix(notepad-guard): refuse Write tool for .sisyphus/notepads files (#3685)

Adds a new `notepad-write-guard` hook that intercepts Write tool calls
whose target path matches `**/.sisyphus/notepads/**` and throws an
actionable error instead of allowing the write to proceed.

Without this guard, an agent that hits an Edit hash-mismatch failure
could silently fall back to Write, destroying the entire history of an
append-only notepad file (decisions.md, issues.md, etc.).  The file
carries an explicit "NEVER overwrite" warning that the agent ignores
under context pressure.

The guard is path-based so it works regardless of plan name or nesting
depth.  Non-notepad `.sisyphus/**` paths (e.g. plan files) are
unaffected.  The hook is wired into `create-tool-guard-hooks` under the
hook name `notepad-write-guard` and follows the same safeCreateHook +
HookName schema pattern as every other tool-guard hook.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/hooks/index.ts

@@ -66,3 +66,4 @@ export { createTodoDescriptionOverrideHook } from "./todo-description-override"
 export { createWebFetchRedirectGuardHook } from "./webfetch-redirect-guard"
 export { createLegacyPluginToastHook } from "./legacy-plugin-toast"
 export { createFsyncSkipWarningHook } from "./fsync-skip-warning"
+export { createNotepadWriteGuardHook } from "./notepad-write-guard"