fix(tree): reject non-string hook matchers - #164

Problem

check_hooks() validates the matcher group and its handlers, but accepts a non-string matcher, such as 42, true, a list, or an object. tree.validate(CODEX_SURFACE, proposed) consequently accepts these proposals and reports one hook file.

The pinned Codex 0.144.6 schema declares MatcherGroup.matcher as Option<String>. Its discovery loader deserializes the entire HooksFile; an incompatible matcher causes it to warn and discard the file, including otherwise valid sibling hooks.

Change

Reject non-null, non-string matchers at the existing proposal-validation boundary, with the file, event, and group index in the error. Preserve missing/null/string matchers and keep accumulating handler errors. Do not coerce or rewrite the proposed JSON.

Regression tests exercise the public tree.validate() entry point: eight invalid values; missing, null, empty, plain, and regex-string controls; and an invalid group among valid siblings.

Related: #142 checks handler command types. This PR checks group matcher types only; it does not include the command or timeout changes.

Verification

python -B -m unittest discover -s tests -p test_hook_matcher_validation.py -v

• Python 3.12.14 before the fix: Ran 3 tests / FAILED (failures=9).
• After the fix: Ran 3 tests / OK.
• Restoring only tree.py in an independent copy restores the same nine failures.
• Ruff check, Ruff format check, and git diff --check pass.

I also ran the complete suite on the baseline plus the new tests and on the patch. Neither full suite is green in this environment, so this is not a claim of full-suite acceptance:

The failing case names are identical after removing the nine fixed matcher failures; no new failing case was introduced. Existing failures include POSIX-only imports on Windows and fixture/provenance checks in the full suite. No Codex/model invocation or benchmark run was used; the downstream loader behavior above was checked against the pinned source.

The reproducer and tests above were executed locally.