fix(hooks): preserve stderr and exitCode in hookResult error paths

When runHook encounters a timeout or handler error, it must preserve
the handler's stderr output and set exitCode to -1 so aggregate can
surface them correctly. The refactoring that embedded HandlerResult
into hookResult inadvertently broke this by returning a zero-valued
HandlerResult (empty stderr, exitCode=0) on error paths.

This is critical for PreToolUse fail-closed semantics: when a hook
fails to execute, aggregate reads r.Stderr to include in the denial
message. Without this fix, the stderr is lost and users see only
"PreToolUse hook failed to execute: <err>" without the underlying
command's diagnostic output.

The fix explicitly constructs HandlerResult{Stderr: res.Stderr,
ExitCode: -1} in both error returns, matching the old behavior where
runHook mutated r.stderr and r.exitCode before returning.

Assisted-By: docker-agent

Author: dgageot

pkg/hooks/executor.go

@@ -218,10 +218,16 @@ func (e *Executor) runHook(ctx context.Context, hook Hook, inputJSON []byte) hoo
 		if errors.Is(ctxErr, context.DeadlineExceeded) {
 			reason = fmt.Sprintf("timed out after %s", hook.GetTimeout())
 		}
-		return hookResult{err: fmt.Errorf("hook %q %s: %w", hook.Command, reason, ctxErr)}
+		return hookResult{
+			HandlerResult: HandlerResult{Stderr: res.Stderr, ExitCode: -1},
+			err:           fmt.Errorf("hook %q %s: %w", hook.Command, reason, ctxErr),
+		}
 	}
 	if err != nil {
-		return hookResult{err: err}
+		return hookResult{
+			HandlerResult: HandlerResult{Stderr: res.Stderr, ExitCode: -1},
+			err:           err,
+		}
 	}
 
 	// Fall back to the legacy "parse JSON from stdout" protocol.