hook: catch-all conflates spawn-denied with binary-missing -> wrong guidance on permission policy changes (P2)

[systemfsoftware-maker]

Source: ce-code-review run 20260830-212446-4b8b0529 (adversarial residual risk + reliability P2/75).

What

hooks/run.ts catch-all returns undefined for every spawn failure identically. A future host policy restricting --allow-run (or a denied spawn) surfaces as 'install it' guidance instead of a permission diagnostic, and the flake guidance branch can be misread.

Also in this class

• Spurious deno Info Failed to resolve 'comment-checker' for allow-run noise on stderr when the binary is absent (reliability P2/75 manual).
• Deno.exit(undefined) coercion risk if the pass-through guard is ever removed (reliability P2/100, currently guarded).

Carried by PR #92: #92