scripts: check-hook-exec-form and check-hook-userconfig-argv duplicate the manifest trust-boundary walk - extract a scripts/lib seam

[kyle-sexton]

Context

Found by the repo-wide /code-tidying:batch-simplify sweep (62 groups / 986 files, branch claude/repo-code-tidying-batch-twhddw). Deferred from the sweep as dedicated-PR-shaped work: the consolidation crosses file or contract boundaries a behavior-preserving sweep must not cross.

scripts/check-hook-exec-form.sh:227-289 and scripts/check-hook-userconfig-argv.sh:84-139 duplicate the scan_manifest_path trust-boundary check and manifest hooks_type walk nearly verbatim. Cross-file seam extraction is dedicated-PR shape (precedent #3144, #3181) and needs fixture-staging changes in both suites.

Proposed work

• Extract the shared walk into scripts/lib with both gates consuming it; keep per-gate output contracts byte-identical.

Acceptance criteria

• One shared implementation; both gate suites green with unchanged transcripts.

References

• scripts/check-hook-exec-form.sh:227
• scripts/check-hook-userconfig-argv.sh:84

Filed by the /code-tidying:batch-simplify closeout (Phase 8).