fix: land resolve-conflicts pushes through PR pre-push hooks

[danii1]

Problem

devintern resolve-conflicts <pr-url> resolved conflicts but never pushed them (seen on #98). The PR's failure comments showed push-failed: the push was rejected by the target repo's lefthook pre-push hook running inside the /tmp review worktree.

Root cause chain:

1. installDependencies (bun install) in the review worktree runs dependency postinstalls; lefthook's postinstall rewrites git hooks via lefthook install. A linked worktree shares .git/hooks with the user's checkout, so the user's real hooks were overwritten with scripts hardcoding the ephemeral worktree's node_modules path (/tmp/devintern-review-worktree-<branch>/...).
2. Since 5a427fd the worktree is always removed after the run, so those hook paths dangle and every later push fails — both from the worktree and from the user's own checkout.

Changes

Hook isolation (src/lib/utils.ts):

• New Utils.isolateWorktreeHooks(), called in prepareReviewWorktree before installDependencies (both the reuse and fresh-creation paths).
• Enables extensions.worktreeConfig and points per-worktree core.hooksPath at the worktree's git admin dir (.git/worktrees/<name>/hooks), seeded with copies of the shared hooks. Postinstall rewrites are confined to the ephemeral worktree, stay valid for its pushes, and vanish with it. The dir lives outside the working tree, so it's invisible to git status, git clean, and git add -A.

Hook-failure retry (src/lib/conflict-resolver.ts):

• Push failures carrying hookError are handed to the agent (buildHookFixPrompt, up to MAX_HOOK_FIX_ATTEMPTS = 2), mirroring the review flow's hook fixer; leftover changes are amended into the merge commit before each retry.
• A branch race (leaseSha moved) skips the agent entirely — the existing defer/retry handling stays authoritative, so no agent runs are burned on races.

Testing

• 5 new tests: hook-fix retry lands the push, amend folding, hook isolation (redirect + copies, postinstall rewrite shielding, isolated hook actually runs on push).
• Full package suite: 1281 pass, typecheck/lint/format clean.

Follow-up note

Existing local clones whose .git/hooks were already poisoned still point at deleted worktrees (the /node_modules fallback usually still resolves); re-running lefthook install in affected clones restores them.