roots: install hosted hooks and wire the executor from the root, not the CLI

Two review findings from the fable pass, both fixed here.

git ents setup --hosted <path> is the missing command: nothing in git-ents actually installed the pre-receive/post-receive hooks into a hosted bare repository before this, meaning a real deployment with missing hooks would silently accept every push completely ungated - stock git’s receive-pack enforces nothing on its own. --hosted resolves or generates a signing key for the hosted worker (the same key logic setup already had, now shared via resolve_or_generate_key) and writes this binary’s own current_exe() into hooks/pre-receive and post-receive, executable. It skips receive.denyCurrentBranch=updateInstead, the local-root checked-out-worktree edge case, meaningless for a bare repository. tests/hosted_root.rs now exercises the real command over a subprocess instead of writing hook scripts itself.

DockerExecutor/SpriteExecutor construction moves from exe.rs into LocalRoot/HostedRoot: root.rs’s own doc claimed "every trait implementation is selected here…​ and nowhere else", but the CLI dispatcher was the one actually constructing the executor, and roots.local requires the local root itself to wire a Docker executor. Both roots now carry a boxed Executor field; exe.rs only ever reads root.executor. This also removes the doc’s reference to a --executor flag that was never implemented - LocalRoot fixes DockerExecutor unconditionally, since nothing in cli.rs lets a caller choose otherwise. HOSTED_WORKER_NAME is the one place the hosted worker’s Sprite name and result-commit author name are named, shared by root.rs and hook.rs instead of two literals kept in sync by hand.

Smaller fixes alongside: hook.rs’s comment claiming gix_odb::at follows a quarantine’s own info/alternates back to the real odb was stale (it never did; QuarantineObjects is the actual mechanism, verified by its own tests) - corrected to point at that type. read_effect’s unparsable- trigger case now returns Ok(None) instead of propagating through ?, matching its own doc ("nothing to run, not a hard failure") instead of aborting the whole post-receive drain over one pre-existing malformed effect. write_dir_as_tree now refuses a non-UTF-8 filename instead of silently mangling it through to_string_lossy.

Not fixed, noted instead: HostedRoot::open always runs a full reconcile scan even when opened just for pre-receive’s gate check, which never reads it - flagged as a non-blocking performance observation, not a correctness issue, and left alone rather than reshaping the constructor’s public signature under time pressure.

Assisted-by: Claude:claude-sonnet-4-6