Feature request: optional blocking pre-write hook for deterministic integrations (e.g. Clash)

Summary

Request an optional blocking pre-write hook in Codex so external guard tools (like Clash) can deterministically prevent conflicting file mutations in multi-agent sessions.

Why this matters

We use Codex in parallel-agent workflows where two agents can touch the same files/branches/worktrees at the same time.

For this class of problem, deterministic enforcement is required:

• Skills/MCP are useful, but not guaranteed to run on every mutating step.
• A pre-write hook in the core execution path can guarantee policy checks before mutation.

Clash is one concrete integration target:

• https://github.com/clash-sh/clash

Proposed scope (small and optional)

Add a hook event before mutating tool actions (e.g. apply_patch and other write paths), with a strict result contract:

• allow -> continue
• deny (+ reason) -> block mutation and surface reason to user/agent

Default behavior remains unchanged when not configured.

Why this should fit current direction

This builds on existing hook work:

• #9691 (hooks foundation)
• #11335 (AfterToolUse hook)
• #11615 (hook errors)
• #2109 (Event Hooks thread)

Ask

Is this direction aligned for Codex core hooks?

If yes, I can provide a tighter event schema + behavior spec first.
If invited, I can then submit a focused PR.