Security reminder should return explicit PreToolUse denial output

Summary

The security reminder hook blocks via stderr + exit code but does not emit a hookSpecificOutput.permissionDecision per the documented PreToolUse contract.

Steps to Reproduce

1. Trigger a security reminder (e.g., edit a workflow file).
2. Observe hook output in PreToolUse.

Expected Behavior

Hook output includes permissionDecision: "deny" and a systemMessage explaining the block.

Actual Behavior

Only stderr output and exit code are used.

Proposed Fix

Emit structured JSON with hookSpecificOutput.permissionDecision: "deny" and systemMessage when blocking.