fix: use private files for generated hook commands

[willkill07]

Overview

Generate short native hook commands that load private Relay-owned configuration, preventing Windows command-line overflow without exposing gateway URLs or generation tokens.

• I confirm this contribution is my own work, or I have the right to submit it under this project's license.
• I searched existing issues and open pull requests, and this does not duplicate existing work.

Details

• Store generated hook settings in versioned private config files.
• Generate persistent and transparent Codex/Claude Code hooks with --hook-config.
• Remove generated PowerShell encoded-command envelopes and update migration documentation.

Where should the reviewer start?

Start with crates/cli/src/hooks/config.rs and crates/cli/src/hooks/encoding.rs; they define the private config contract and compact command generation.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Relates to: AEP-94

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Fern docs preview: https://nvidia-preview-pull-request-939.docs.buildwithfern.com/nemo/relay/dev