fix: valid Claude Code hook schema + merge existing hooks on install

[lngyeen]

Summary

• Hook schema fix: Use proper Claude Code format with nested hooks: [{type, command}] arrays instead of flat command: fields. Remove unsupported PreCommit event. Narrow PostToolUse matcher from Edit|Write|Bash to Edit|Write since Bash commands don't directly modify source files.
• Merge logic: install_hooks() now merges new entries into existing hooks instead of overwriting them via existing.update(). Creates a settings.json.bak backup before modification.

Motivation

code-review-graph install generates invalid settings.json that causes Claude Code to fail on startup with:

hooks.PostToolUse.0.hooks: Expected array, but received undefined
hooks.SessionStart.0.hooks: Expected array, but received undefined

Additionally, the existing.update(hooks_config) call replaces the entire hooks key, silently destroying user-defined hooks (e.g., linters, formatters, safety checks).

Closes #97, #114, #172

Changes

File	Change
skills.py:generate_hooks_config()	Proper Claude Code schema, removed Bash matcher and PreCommit
skills.py:install_hooks()	Merge-based hook installation with backup
tests/test_skills.py	Updated tests for schema validation and merge behavior

Test plan

• All 29 skills tests pass
• All 621 tests pass with zero regressions
• Verified generated hooks load correctly in Claude Code v2.1.92

[tirth8205]

This PR addresses the hooks schema bug (#97, #114, #172, #188, #191, #201) which is still not fixed in main. The current skills.py:generate_hooks_config() still generates the invalid schema. This PR provides exactly what's needed: proper nested hooks arrays, removal of PreCommit/SessionStart (invalid events), narrowed PostToolUse matcher, and merge-based installation with backup. Worth reviving — this is the #1 most-reported bug in the issue tracker.

[lngyeen]

Rebased onto latest main — conflicts resolved, all 46 skill tests passing. The hook schema changes from #208 are now upstream, so this PR's scope is narrowed to the merge logic (append-don't-overwrite user hooks) + backup (settings.json.bak) + a detailed schema regression test. Ready for re-review.