fix(hooks): address Codex review — tighten codec to the reference schemas, preserve stdout

Codex's PR-E review found three protocol-fidelity blockers + two doc gaps, all
verified against ~/repos/refs:

- (A) Top-level `decision` accepted allow/deny/ask, but both reference schemas
  reserve those for hookSpecificOutput.permissionDecision — the legacy top-level
  decision is approve/block ONLY. Split topLevelDecisionOf (approve/block) from
  permissionDecisionOf (allow/deny/ask), so an out-of-band {"decision":"deny"} is
  now invalid and ignored instead of becoming a real blocking decision.
- (A) hookSpecificOutput was parsed without its hookEventName discriminator.
  HookOutput now surfaces hookEventName so a bridge can discard a block whose
  claimed event doesn't match the firing one (the schemas key the block by event).
- (A) runHook discarded raw stdout. HookOutput now carries `stdout` (trimmed,
  verbatim) so a bridge can reproduce CC's plain-stdout rendering / Codex's
  plain-stdout-as-additionalContext behavior.
- (B) hook/* SessionEventMap variants were only named in prose; added a payload/role
  table to core-data-structures/session.md (a maintained catalog surface).
- (B) Removed PR-stack-position references (PR-F / "future bridge packages") from a
  test comment and the RFC, per the current-state-wording rule.

New codec tests: top-level allow/deny/ask invalid+ignored, hookEventName capture,
raw stdout preserved on plain + JSON + empty stdout. 51 tests, per-file 100%.

packages/hooks/hook-protocol/tests/codec.spec.ts

@@ -48,11 +48,25 @@ describe('parseHookOutput — structured stdout (exit 0 only)', () => {
     expect(out.systemMessage).toBe('heads up')
   })
 
-  it('parses legacy top-level decision + reason (approve/block)', () => {
+  it('parses legacy top-level decision + reason (approve/block ONLY)', () => {
     expect(parseHookOutput(0, JSON.stringify({ decision: 'block', reason: 'nope' }), '').decision).toBe('block')
     expect(parseHookOutput(0, JSON.stringify({ decision: 'approve' }), '').decision).toBe('approve')
   })
 
+  it('a top-level decision of allow/deny/ask is INVALID and ignored (reserved for permissionDecision)', () => {
+    // Both reference schemas restrict the legacy top-level `decision` to
+    // approve/block; allow/deny/ask must come from hookSpecificOutput.permissionDecision.
+    expect(parseHookOutput(0, JSON.stringify({ decision: 'deny' }), '').decision).toBeUndefined()
+    expect(parseHookOutput(0, JSON.stringify({ decision: 'allow' }), '').decision).toBeUndefined()
+    expect(parseHookOutput(0, JSON.stringify({ decision: 'ask' }), '').decision).toBeUndefined()
+  })
+
+  it('captures hookEventName from hookSpecificOutput (the discriminator a bridge validates)', () => {
+    const out = parseHookOutput(0, JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny' } }), '')
+    expect(out.hookEventName).toBe('PreToolUse')
+    expect(out.decision).toBe('deny')
+  })
+
   it('hookSpecificOutput.permissionDecision OVERRIDES the legacy top-level decision', () => {
     const out = parseHookOutput(0, JSON.stringify({
       decision: 'approve',
@@ -89,6 +103,20 @@ describe('parseHookOutput — structured stdout (exit 0 only)', () => {
     const out = parseHookOutput(0, 'just some text output', '')
     expect(out.decision).toBeUndefined()
     expect(out.continue).toBeUndefined()
+    // The raw stdout is preserved verbatim so the bridge can render/use it
+    // (CC output; Codex additionalContext) — trimmed.
+    expect(out.stdout).toBe('just some text output')
+  })
+
+  it('preserves raw stdout (trimmed) alongside parsed structured fields', () => {
+    const json = JSON.stringify({ decision: 'block' })
+    const out = parseHookOutput(0, `  ${json}  \n`, '')
+    expect(out.stdout).toBe(json)
+    expect(out.decision).toBe('block')
+  })
+
+  it('stdout is empty string when the hook emits none', () => {
+    expect(parseHookOutput(0, '', '').stdout).toBe('')
   })
 
   it('a JSON array stdout parses but yields no fields (not an object)', () => {