fix: allow Safehouse to run cmux agent hooks (TG-4209)

Approve — the direction is correct and the conditional path handling is clean. The new addDirs contract slot and the existsSync guards on both the hooks dir and Sentry cache dir are wired through consistently from resolver to CLI to tests. The two CodeRabbit concerns are worth resolving but don't change the call: the toContain + expect.stringContaining assertion on the new lines 345-347 is silently ineffective (it'll always pass, even if --add-dirs= appears), and the existing fixed-home tests are now one degree more fragile against host filesystem state.