fix hook policy open failures

Treat agent and Git hook repository open failures as unreadable checkpoint policy.

Agent hook policy lookup is separated from policy evaluation so callers decide how session-start and later hooks respond.