The generated check-gstack.sh emitted a flat permissionDecision payload and
exited 0, which Claude Code ignores — required mode enforced nothing. The
generated hook now nests the deny under hookSpecificOutput and exits 2 so
the block holds even if the JSON schema drifts again. Adds a temp-repo
regression test that runs the generated hook under both installed and
missing-gstack homes.
Fixes#2413, #2296.
Contributed by @Masashi-Ono0611 (PR #2423).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Garry Tan