[codex] add before_agent_reply plugin hook for system turns

[furukama]

Summary

• add a before_agent_reply plugin hook that can claim a turn, return synthetic text, or swallow it silently
• wire the hook into gateway chat, bootstrap autostart, heartbeat runs, isolated scheduled tasks, and scheduled system_event delivery
• add focused coverage for plugin-manager hook ordering/failure handling plus chat, bootstrap, heartbeat, and scheduler interception paths

Why

Heartbeat and scheduler-triggered system turns previously relied on prompt conventions or direct delivery paths. This hook gives plugins a deterministic interception point for plugin-managed maintenance and background work without forcing an LLM turn.

Impact

Plugins can now own system-managed turns before agent execution starts. They can:

• short-circuit normal agent execution with a synthetic reply
• consume heartbeat or scheduler turns silently
• use the same hook contract across chat, bootstrap, heartbeat, and scheduler surfaces

Root Cause

HybridClaw had before_agent_start, but no claimable reply-phase hook for plugin-managed system turns. That left heartbeat and scheduler flows dependent on prompt-level conventions instead of an explicit plugin seam.

Validation

• node_modules/.bin/vitest run --configLoader runner --config vitest.unit.config.ts tests/plugin-manager.before-agent-reply.test.ts tests/gateway-service.plugins.test.ts tests/gateway-service.bootstrap-autostart.test.ts tests/heartbeat.test.ts tests/scheduled-task-runner.before-agent-reply.test.ts
• npm run typecheck
• git diff --check

Notes

• the direct scheduled system_event interception path is implemented but does not yet have dedicated test coverage