limit hook policy gate to checkpoint writes

Keep SessionStart warning-only and let non-writing lifecycle hooks dispatch when checkpoint policy cannot be satisfied.

This preserves TurnStart session initialization and context injection while still blocking hooks that directly write checkpoint data.