Hook-ask permission prompts default to Yes; a stray Enter publishes

A PreToolUse hook returning permissionDecision: "ask" renders the standard permission prompt, and pressing Enter accepts it. For a hook guarding an outward action — ours guards git push — that default runs the wrong way: an engineer typing into the wrong window publishes with one keystroke.

We hit this. A "Publish now?" prompt was answered about 25 seconds after it rendered, and the engineer did not remember answering it; the branch went to the remote.

Please let a hook mark its ask as default-deny, for instance {"permissionDecision": "ask", "defaultAnswer": "deny"}, so that Enter and Escape both refuse and publishing takes a deliberate keystroke.