[ai] Replace guard-commands with block-builds, block, and create hooks.

[ai] Replace guard-commands with block-builds, block, and create hooks.

Splits the monolithic guard-commands hook into three single-purpose
hooks with more granular matchers in settings.json.

block-builds:
Guards guix and make build/reconfigure commands. Asks on main,
denies in for destructive operations (reconfigure,
home-*, system-*).

block:
Denies git checkout/switch outright. Enforces Enter
(must not already be in a ) and Exit (must not
have unpushed commits diverging from main). Sends a desktop
notification on Enter success.

create:
Uses a universal matcher ("*") to deny all tool calls on main
unless already inside the session's . Allows
Enter through to let the user enter an isolated session.