fix(hooks): preserve exec bit on re-run and fix pipefail on empty grep

Two bugs in setup-hooks.sh:
1. awk+mv to replace a marker block created a 644 temp file, losing the
   exec bit. chmod +x after every write_block call fixes this. Regression
   test added to idempotency block.
2. set -euo pipefail in the deployed pre-commit hook caused grep to exit 1
   when no files of a given type were staged, aborting the hook. Changed
   all filter pipes to process substitution with || true so no-match is
   handled gracefully.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ

tests/test-setup-hooks.sh

@@ -158,6 +158,11 @@ for hook_file in "$REPO5/.git/hooks/commit-msg" "$REPO5/.git/hooks/pre-commit" "
   else
     fail "idempotent: $hook_name marker appears $count times — block duplicated"
   fi
+  if [[ -x "$hook_file" ]]; then
+    pass "idempotent: $hook_name remains executable after 3 runs"
+  else
+    fail "idempotent: $hook_name lost executable bit after repeated runs"
+  fi
 done
 
 # --- 7. Hooks contain graceful degradation paths for missing tools ---