fix(orgtrack): connect Codex hook trust flow

[Neonforge98]

Summary

• separate managed-hook installation from runtime activation so Codex reports awaiting_approval until the current ORG2 hook definition actually runs
• persist an atomic, versioned activation receipt keyed by a fingerprint of only ORG2-managed Codex hooks, preserving unrelated user hooks and invalidating stale approvals when managed definitions change
• add a localized Needs approval UX that opens a dedicated named Codex terminal in the current/primary workspace and silently refreshes to Active after the first real hook callback
• make controlled terminal setup reliable across Agent Station and Code Editor without weakening the user-facing terminal creation throttle
• extend the rendered runtime-hooks E2E to cover the native Codex review screen and the post-approval adapter/activation loop without automating the user's trust decision

Test plan

• pnpm run typecheck
• pnpm exec vitest run src/api/tauri/rpc/__tests__/sessionProvenanceSchemas.test.ts src/store/workstation/codeEditor/terminal/__tests__/terminalAtoms.test.ts (25 passed)
• cargo test -p agent_cli session_provenance --lib (31 passed)
• cargo check -p org2
• commit hooks: lint-staged, scoped TypeScript check, and cargo clippy for agent_cli + org2
• integrations i18n completeness check (0 missing)
• real macOS Tauri/WebDriver runtime-hooks scenario twice consecutively (native Codex hook review prompt, installed adapter callback, automatic active; 1 passed / 16 filtered each run)

Submit checklist

• The PR is focused and has a scoped Conventional Commits title, such as feat(scope): summary or fix(scope): summary.
• I ran the relevant checks, or explained why they were not run.
• No secrets, private config, generated output, or unrelated formatting changes are included.
• Docs, screenshots, and locale updates are included when the change needs them.