fix(cli): harden adf-patch / serve / hook error paths surfaced by telemetry triage

[stackbilt-admin]

Origin

Found by sweeping local .charter/telemetry/events.ndjson across org repos that run the Charter CLI. Telemetry records command metadata only (no content); the actionable signal is the exit code + errorName — an uncaught throw (TypeError/Error/unnamed) at exit 2 is a real crash, a CLIError is a clean rejection.

Changes, by confidence

Lead	Outcome	Confidence
adf patch --ops	Fixed. Malformed ops ([null], non-object) crashed captureOpBefore with an uncaught TypeError because it ran before applyPatches validated. Now validated against a Zod PatchOperationArraySchema at the parse boundary → clean CLIError, file untouched. Reproduced the exact crash before & after.	✅ Confirmed (reproduced)
serve --ai-dir	Hardened. "Not found" errors now echo the resolved --ai-dir/manifest path, so a wrong path is obvious instead of retried blind.	🟡 Plausible cause, low-risk
hook install	Hardened. fs.mkdirSync/writeFileSync and git-dir resolution failures escaped as raw Error; both now wrap into a CLIError. The widened guard makes "hook install yields clean errors, not raw throws" true regardless of which surface fails.	🟡 Root cause unconfirmed (no stack in telemetry)
stamp-policies	No change — investigated and confirmed working as designed (clean handled exit-2 with recovery hint).	—

Design notes

• The Zod ops schema lives in the CLI, keeping @stackbilt/adf zero-dep. A compile-time drift guard asserts z.infer stays mutually assignable with adf's public PatchOperation type — they can't silently diverge. Migrating the schema into @stackbilt/adf as source-of-truth is a deliberate follow-up, not folded in here.
• zod ^3.24.1 declared in the CLI package.json (was already imported but undeclared).

Verification

• tsc --noEmit clean
• Full suite 575/575 (49 files), +7 new tests covering all four adf-patch repro cases, both serve guards, and both hook failure surfaces (the hook write-failure test uses a real fs failure, not a mock)

🤖 Generated with Claude Code