docs(agents): refine CLI tracking and role controls

[i9wa4]

Summary

• Refresh the Claude Code and Codex CLI reference material for role controls, hook behavior, optimization tracking, and operating contracts.
• Clarify the boundary between product hook capabilities and repository policy, including the current non-enforcing observer behavior.

Why

These references needed to describe the current controls consistently so contributors can distinguish documented guidance from active enforcement.

Impact

• Gives users and maintainers a clearer view of agent roles, hook context, and CLI-specific configuration boundaries.
• Documents the separate minimal Codex bundle and the limitations of the existing write observer.

Limitations and non-changes

• Documentation only: this change adds no new live enforcement, permissions, hooks, or runtime behavior.
• Existing role-control limitations remain unchanged.

Validation

• git diff --check
• nix run .#check