fix(extension): Windows hook dedupe, POSIX node preflight, stale-path prevention

[George-iam]

Why

Companion to #149 (core CLI launch-readiness). Fixes the extension-channel blockers from the pre-launch audit — all reproduced against the shipped 0.1.5 .vsix or live machine state.

Fixes

1. Windows: hooks duplicated on every restart and were unremovable (CRITICAL, shipped in 0.1.5)

The install/uninstall dedupe filter matched \"axme-code\" in the command string — but the Windows command is \"%USERPROFILE%\\.cursor\\axme-hook.cmd\" hook <name> --ide cursor, which never contains it. Every Cursor restart appended 3 fresh entries (N restarts → N× hook fan-out on every tool call); uninstall/AXME: Reset used the same filter, so stale entries could never be removed — and after uninstall they pointed at a deleted wrapper, failing forever. Shared isAxmeHookEntry() now matches both command shapes.

Bonus: since installUserHooks already rewrites axme entries on every activation, the fixed filter also makes version-dir paths self-heal after extension updates (observed live: ~/.cursor/hooks.json pointing at the 0.1.0 extension dir with 0.1.4 installed).

2. POSIX: Node-less users got an undebuggable dead extension (CRITICAL)

The bundled CLI is a #!/usr/bin/env node shim; Cursor spawns the MCP server outside the extension host. macOS/Linux users without Node 20+ (common for non-JS stacks — exactly our audience) saw MCP server does not exist in chat and silently failing hooks, with zero explanation. New activation step node (POSIX only, soft-fail — a false negative must not brick a working install): actionable error with an Open nodejs.org button, recorded in the activation report and reflected in the status bar. Windows reports bundled.

3. Extension-spawned setup wrote duplicate/stale project config (CRITICAL)

setup --ide cursor spawned by the extension wrote project-level .cursor/mcp.json (same-name axme server with PATH-dependent command — extension-only users have no axme-code on PATH) and .cursor/hooks.json (absolute paths into the version-numbered extension dir, never rewritten → stale after every update, plus double-firing on top of user-level hooks). The spawn now sets AXME_SETUP_FROM_EXTENSION=1; the CLI side (#149) skips both writers when present. Standalone-CLI cursor users are unaffected.

4. ~/.cursor/hooks.json refuse-don't-clobber

A malformed user file was silently overwritten ("will overwrite"), destroying the user's own hooks — same bug class as the config clobbering fixed in #149. Now throws an actionable error that the activation report surfaces as a visible warning with recovery steps.

5. Misleading bundled-Node error texts

Three error messages (and a doc comment) referenced extension/bin/node-windows-x64.exe; the real path is extension/bin/node-runtime/node.exe. Users checking the "missing" file found it present and got stuck.

Order of merge

Either order works, but full effect of fix 3 requires both this PR and #149 (env producer here, consumer there). Ship both in v0.6.1 / extension-v0.1.6.

Verification

• tsc --noEmit clean (extension)
• Extension builds (out/extension.js)
• No behavior change for healthy installs: dedupe still preserves user entries verbatim; node preflight is a no-op pass on machines with Node 20+; env var only affects extension-spawned setup
• CI matrix builds 5 platform .vsix (runs on this PR)

🤖 Generated with Claude Code