fix: trust installed Codex hooks

.github/workflows/ci.yml

@@ -334,15 +334,15 @@ jobs:
           xcodebuild -project GhosttyTabs.xcodeproj \
             -target programa-cli \
             -configuration Debug \
-            CONFIGURATION_BUILD_DIR="$CLI_REGRESSION_DIR" \
+            SYMROOT="$CLI_REGRESSION_DIR" \
             CODE_SIGNING_ALLOWED=NO \
             build
 
       - name: Run typed CLI registry behavior regression
         run: |
           set -euo pipefail
 
-          CLI_BIN="$RUNNER_TEMP/programa-cli-regression/programa"
+          CLI_BIN="$RUNNER_TEMP/programa-cli-regression/Debug/programa"
           if [ -z "${CLI_BIN:-}" ] || [ ! -x "$CLI_BIN" ]; then
             echo "programa CLI binary not found in DerivedData" >&2
             exit 1
@@ -354,14 +354,26 @@ jobs:
         run: |
           set -euo pipefail
 
-          CLI_BIN="$RUNNER_TEMP/programa-cli-regression/programa"
+          CLI_BIN="$RUNNER_TEMP/programa-cli-regression/Debug/programa"
           if [ -z "${CLI_BIN:-}" ] || [ ! -x "$CLI_BIN" ]; then
             echo "programa CLI binary not found in DerivedData" >&2
             exit 1
           fi
 
           PROGRAMA_CLI_BIN="$CLI_BIN" python3 tests/test_cli_argument_grammar.py
 
+      - name: Run Codex hook trust regression
+        run: |
+          set -euo pipefail
+
+          CLI_BIN="$RUNNER_TEMP/programa-cli-regression/Debug/programa"
+          if [ -z "${CLI_BIN:-}" ] || [ ! -x "$CLI_BIN" ]; then
+            echo "programa CLI binary not found in DerivedData" >&2
+            exit 1
+          fi
+
+          PROGRAMA_CLI_BIN="$CLI_BIN" python3 tests/test_cli_codex_hook_trust.py
+
       - name: Run unit tests
         env:
           PROGRAMA_UNIT_TEST_SCOPE: split-stateful