feat(hook): say why a hook is invalid

[dadgrand]

Summary

• reasonix hook list --json reports "status": "invalid" for five distinct conditions without saying which one fired, so a misconfigured hook gives the operator nothing to act on.
• The matcher branch is the clearest case: it calls hook.ValidateMatcher, which already builds a full error message, and then discards it.
• Report the reason alongside the status. Active entries carry no reason, so existing consumers see an unchanged shape.

invalid — unknown event "NotAnEvent"
invalid — command is required
invalid — contextFile "…" is not readable
invalid — plugin hook has neither a command nor a contextFile
invalid — invalid matcher regex: error parsing regexp: missing closing ): `^(?:()$`

This matters most when porting hooks from Claude Code, which internal/hook goes to some length to support elsewhere — tool-name aliases across Claude renames (Task→Agent, BashOutput→TaskOutput), PayloadFormat "claude", CLAUDE_PROJECT_DIR/CLAUDE_PLUGIN_ROOT. Claude's nested form:

{"matcher":"*","hooks":[{"type":"command","command":"…"}]}

leaves Command empty, so it lands on the command check and now answers command is required instead of a bare invalid.

Issues

Verification

• go test ./... passes. gofmt -l . and go vet ./... clean. Go 1.26.2, darwin/arm64.
• The existing TestHookMachineEntryStatusRejectsNonRegularContextFile is updated for the two-value signature and still passes unchanged in intent.
• New TestMachineHookEntryStatusExplainsEveryRejection covers unknown event, missing command and a malformed matcher regex; TestMachineHookEntryStatusLeavesActiveEntriesUnexplained pins that an active entry emits no reason, so the JSON shape is unchanged for the common case.
• Checked against a real config on each of the five paths, plus the Claude-style nested form.

Documentation impact

Documentation-impact: none - additive, optional field on an existing diagnostics payload; no CLI, config, provider, permission or tool behavior changes.

Cache impact

Cache-impact: none - hook list --json output never enters the provider request; no system prompt, memory prefix, tool schema, tool surface or provider serialization is touched.
Cache-guard: not applicable - no cache-sensitive path is modified.
System-prompt-review: N/A