Codex CLI notifications: how the notify hook actually works

The notify hook has exactly one event, hands you the payload as an argv argument rather than on stdin, and can never block a tool call. The verified payload shape, a runnable script, per-run vs global wiring, and when to reach for lifecycle hooks instead.