Addresses #26383 and #26452
## Summary
`codex exec --dangerously-bypass-hook-trust` printed the bypass warning,
but valid untrusted hooks still did not run.
Exec applied the flag to its initial config, then lost it when
app-server reloaded config for the new or resumed thread.
## Fix
Forward `bypass_hook_trust: true` through the existing thread request
config override for both start and resume.
The override is omitted when the flag is not enabled, preserving normal
trust behavior.
## Testing
Added:
- A test confirming start and resume preserve the override.
- An end-to-end exec test confirming a `SessionStart` hook runs and
creates a marker file.
Abhinav