lefthook guard: recognise install after valued global options, and package runners #1918

The lefthook-hooks-path agent-guard guard (added in #1895) takes the first non-option token as the lefthook subcommand. So a global option that takes its value as a separate argument hides install: in lefthook --colors off install --force, the guard reads off as the subcommand and returns no denial. It also doesn't look through package runners: npx lefthook install --force, pnpm exec, yarn exec/dlx and bunx reach the real binary with no guard. The PATH shim still covers lefthook run directly, so this is defence-in-depth, not a live bypass of the shim.

Separately, guarded_head matches the basename, so /usr/bin/git reaches the bundled guards, while git:* contributed guards still key on a literal argv[0] == "git". Normalising argv[0] once and using it in both places would make the coverage consistent.

Suggested direction: fail closed. Treat a lefthook segment as an install whenever any token equals install. Unwrap the common runners when their target is lefthook. Add tests for each shape.