fix: harden assistant hooks and AST worker fallback

[Ammaar-Alam]

Summary

• run the Codex hook-check command through the current Python environment's entry point instead of a possibly stale graphify binary from PATH
• quote the Codex hook command for POSIX shells and Windows PowerShell
• avoid target-repo graphify.py / graphify/ shadowing when Codex runs the hook from a project cwd
• report hook install/read/write/status failures instead of crashing where filesystem access is denied
• fall back to sequential AST extraction when process workers cannot start or the process pool breaks

Why

This makes Graphify more reliable in venv, uv/pipx, PowerShell, sandboxed, and protected-directory environments without changing the Codex hook payload behavior. hook-check remains a silent no-op and graph guidance still comes from AGENTS.md / installed skills.

Tests

• .venv/bin/python -m pytest tests/test_install.py tests/test_hooks.py tests/test_extract.py -q --tb=short
• .venv/bin/python -m pip install tree-sitter-sql
• .venv/bin/python -m pytest tests/ -q --tb=short
• git diff --check
• .venv/bin/python -m compileall -q graphify
• .venv/bin/python -m graphify update .
• .venv/bin/python -m graphify hook-check

Links

• Helps codex install writes bash-only PreToolUse hook that fails on Windows PowerShell #522
• Refs Support uv-managed Python execution #328
• Follow-up to feat: implement parallel AST extraction with benchmarking support #663