fix(hooks): fail-closed freeze + shared extractor + careful HIGH tier

Freeze boundary hook had four verified bugs: the grep-first JSON extractor
truncated at escaped quotes and failed OPEN on unparseable payloads; the deny
JSON was printf-interpolated so a quote- or newline-bearing path silently
no-oped the block; the freeze path read stripped INTERNAL spaces (a boundary
like ~/My Project could never match); and the path resolver skipped the final
component, letting an in-boundary symlink write through to an out-of-boundary
target.

Fixes, structurally: one shared sourced helper (careful/bin/hook-extract.sh)
now owns JSON extraction and JSON-encoded decision envelopes for BOTH hooks --
the two-copy drift is how freeze kept a broken extractor after careful's was
fixed. Freeze is now deny-tier fail-closed (unparseable payload denies,
parsed-but-no-file_path still allows), trims only leading/trailing whitespace,
and resolves symlinks through the final path component.

Careful gains a HIGH tier (hard deny, simple commands only): recursive delete
of /, ~, or $HOME, and force-push to the repo's default branch. Compound
commands always fall through to the MEDIUM ask; --force-with-lease is never
HIGH. Documented as a best-effort advisory hard-stop, not a policy boundary.
Plus additive-only project patterns (~/.gstack/careful-patterns.txt +
per-project file): config can only ADD warn rules, never suppress a baseline
family.

test/hook-scripts.test.ts: 89 tests incl. malformed-payload deny, parseable
deny JSON for hostile paths, space-bearing boundaries, symlink escape, HIGH
tier splits, additive invariant, invalid-regex resilience.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

freeze/SKILL.md

@@ -76,14 +76,22 @@ again. To remove it, run `/unfreeze` or end the session."
 
 ## How it works
 
-The hook reads `file_path` from the Edit/Write tool input JSON, then checks
-whether the path starts with the freeze directory. If not, it returns a
+The hook reads `file_path` from the Edit/Write tool input JSON (shared
+real-JSON extractor with /careful — one copy, sourced by both hooks), then
+checks whether the path starts with the freeze directory. If not, it returns a
 `hookSpecificOutput` payload with `permissionDecision: "deny"` to block the
 operation (nested under `hookSpecificOutput` — Claude Code ignores a top-level
 `permissionDecision`).
 
+Polarity is fail-closed: a tool payload the hook cannot parse is DENIED, not
+allowed — a boundary that fails open is not a boundary. A payload that parses
+but has no `file_path` (a non-file tool) is allowed. Symlinks are resolved
+through their FINAL component, so an in-boundary symlink pointing outside the
+boundary is checked against its target.
+
 The freeze boundary persists for the session via the state file. The hook
-script reads it on every Edit/Write invocation.
+script reads it on every Edit/Write invocation. Boundaries containing spaces
+are supported.
 
 ## Notes