Drop the hook-template scheme and other dead weight

hooks/hooks.json was generated from a template by scripts/gen-hooks.mjs. Once every
hook became a command hook that reads hook.secret from $GLANCE_HOME itself, the
template had exactly two placeholders left: {{HOOK_TOKEN}}, which nothing had ever
substituted into anything, and {{APPROVAL_TIMEOUT_SECS}}. Generating a whole file to
compute one number is not a good trade, so the number is now fixed at 125s in the
committed hooks.json and the coupling is enforced in code instead: the daemon clamps
approval.timeoutMs to APPROVAL_MAX_WAIT_MS (90s), which keeps the script inside its
own hook timeout no matter what a hand-edited config.json says. Losing that clamp is
what would actually hurt — a killed script never runs its fail-open path.

Also removed:

- `glance sync-hooks`, `npm run build:hooks`, and hookSecret({create}). The daemon is
  the only thing that should ever mint the secret.
- The ?k= query-string carrier for the hook secret. It existed for hooks that cannot
  set headers; there are none, and a secret in a URL lands in logs and shell history.
- Snapshot.now and SessionView.startedAt, which were written on every snapshot and
  every persist and read by nobody.
- An unused crypto import.

Docs and the e2e suite follow. The suite's ~12 sync-hooks assertions become static
checks on the committed file, plus new ones that hooks.json, APPROVAL_HOOK_TIMEOUT_SECS
and APPROVAL_MAX_WAIT_MS still agree, and that ?k= is refused. 220 checks, all passing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

bin/glance-lib.mjs

@@ -8,7 +8,6 @@
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
-import crypto from "node:crypto";
 import { fileURLToPath } from "node:url";
 
 export const PLUGIN_ROOT = path.resolve(fileURLToPath(import.meta.url), "../..");
@@ -49,34 +48,15 @@ export const HOOK_HEADER = "x-glance-hook";
 
 /**
  * The shared secret that admits a caller to /hook/*. Read fresh on every invocation so a
- * regenerated secret is picked up without touching hooks.json.
+ * regenerated secret is picked up without restarting anything.
  *
- * `create` is used by the build-time generator; the hook scripts pass false and simply get
- * null when there is no secret yet. That is deliberate: a hook must never be the thing that
- * creates state, and a missing secret has to degrade to "no telemetry", not "no tool call".
+ * Only the daemon ever creates it. A hook must never be the thing that creates state, and a
+ * missing secret has to degrade to "no telemetry", not "no tool call" — so this returns null
+ * and the callers carry on.
  */
-export function hookSecret({ create = false } = {}) {
-  const file = path.join(glanceHome(), "hook.secret");
-  for (let attempt = 0; attempt < 2; attempt++) {
-    try {
-      const existing = fs.readFileSync(file, "utf8").trim();
-      if (existing) return existing;
-    } catch {
-      /* fall through */
-    }
-    if (!create) return null;
-    fs.mkdirSync(glanceHome(), { recursive: true, mode: 0o700 });
-    const token = crypto.randomBytes(32).toString("base64url");
-    try {
-      // Exclusive: if the daemon created one a millisecond ago, read theirs instead.
-      fs.writeFileSync(file, token + "\n", { mode: 0o600, flag: "wx" });
-      return token;
-    } catch {
-      /* lost the race; loop re-reads */
-    }
-  }
+export function hookSecret() {
   try {
-    return fs.readFileSync(file, "utf8").trim() || null;
+    return fs.readFileSync(path.join(glanceHome(), "hook.secret"), "utf8").trim() || null;
   } catch {
     return null;
   }
@@ -88,17 +68,15 @@ export function hookHeaders() {
 }
 
 /**
- * How long the PreToolUse approval hook is allowed to run, in seconds.
+ * How long the PreToolUse approval hook is allowed to run, in seconds — the `timeout` written
+ * next to glance-approve.mjs in hooks/hooks.json. Change one, change the other.
  *
- * One formula, two consumers: scripts/gen-hooks.mjs writes it into hooks.json as the hook's
- * `timeout`, and glance-approve.mjs derives its own wait from it. They must agree — if the
- * script outlives its hook timeout, Grok Build kills it and the fail-open path never runs.
+ * It bounds everything downstream: if the script outlives its hook timeout, Grok Build kills
+ * it and the fail-open path never runs. So the daemon caps its own wait well inside it (see
+ * APPROVAL_MAX_WAIT_MS in server/src/config.ts), and the script leaves itself 10s on top of
+ * that to answer.
  */
-export function approvalHookTimeoutSecs(cfg = readConfig()) {
-  const ms = Number(cfg.approval?.timeoutMs ?? 90_000);
-  const base = Number.isFinite(ms) && ms > 0 ? ms : 90_000;
-  return Math.ceil(base / 1000) + 35;
-}
+export const APPROVAL_HOOK_TIMEOUT_SECS = 125;
 
 /** Read the hook payload that Grok Build writes to stdin. Returns {} if there is none. */
 export async function readStdinJson() {