refactor(codemode): before/after hooks for tool and extension calls - #49242

Hooks around every call the program makes into the host — tools and extension globals — named after the two things a host registers. They replace onToolCallStart/onToolCallEnd, which only fit tools, needed an index to pair up, and could not deny.

CodeMode.make({
  tools,
  extensions,
  hooks: {
    "tool.before":      (call) => Effect.void,          // { name, input }        fail to deny
    "tool.after":       (call, result) => Effect.void,  // result: how it ended
    "extension.before": (call) => Effect.void,          // { extension, name, args }
    "extension.after":  (call, result) => Effect.void,
  },
})

type CallResult =
  | { status: "success"; value: unknown }
  | { status: "failure"; error: unknown }
  | { status: "interrupted" }

Same shape as the plugin API's execute.before/execute.after. after observes and cannot change the result. The same call object reaches before and after, so a host pairs them by identity with no index. Functions inside an extension result (res.json()) are part of a value's API and do not fire hooks. result.toolCalls and maxToolCalls are unchanged and still count tools only; a denied tool call was still admitted, so it appears in both.

 tool-runtime.ts
-  ToolCallStarted / ToolCallEnded / ToolCallHooks, observeEnd (index, outcome, durationMs, message)
+  ToolInvocation / ExtensionInvocation / CallResult / Hooks
+  hooked(call, before, after, run)   one helper: before, run, after with the outcome; used by tools and extensions
 extensions.ts  wrap(value, label, describe?)
+  a global's call runs inside the extension hooks; the host sees its own thrown/rejected error, then it crosses out

Core

The only consumer migrates here. progressHooks(record) appends a running row in before and settles it in after, keyed by a WeakMap from the call object to its row.

Once #49235 (fetch) lands on top, fetch requests show under execute in the TUI with no further plumbing.

Checks

• packages/codemode bun test 5123 pass / 0 fail. Hook tests cover tools and extensions, denial from either before, a tool defect and an interrupted extension call as seen by after, every previous interruption case, and error location on a bad extension result (parity with other built-in errors).
• packages/core test/tool-execute.test.ts + test/codemode 27 pass; existing toolCalls metadata assertion unchanged.
• bun run check 35/35.