fix: relocate global Rules/Workflows/Hooks from ~/Documents to ~/.dirac (FU-9)

[alexdim]

Summary

• Relocate ensureRulesDirectoryExists, ensureWorkflowsDirectoryExists, and ensureHooksDirectoryExists from ~/Documents/Dirac/{Rules,Workflows,Hooks} to ~/.dirac/{Rules,Workflows,Hooks} via getDiracHomePath().
• Best-effort recursive migration from legacy ~/Documents/Dirac/<subdir>: copies files with COPYFILE_EXCL (idempotent, no clobber), swallows only ENOENT/EPERM/EACCES on the legacy path, logs and rethrows unexpected errors.
• Classify both legacy Dirac/Hooks and new .dirac/Hooks as global hooks.
• Remove the broken catch fallback that re-resolved the same TCC-protected path on mkdir failure.

Why

~/Documents is TCC-protected on macOS since Catalina (10.15). Any process without Full Disk Access gets EPERM on readdir/fs.watch against paths under ~/Documents, even when the directory exists and is readable interactively. This caused ruleLoadErrors to fire on every task run:

{"ruleLoadErrors":["Failed to read .diracrules directory at /Users/.../Documents/Dirac/Rules: Error reading directory at ...: EPERM: operation not permitted, scandir ..."]}

The existing catch fallback re-resolved the same ~/Documents/Dirac/Rules path, so it could never recover from TCC denial. Telling users to grant Full Disk Access is the wrong fix — it's overbroad (gives access to all protected paths, not just the one Dirac needs) and masks the real issue: global config shouldn't live on a TCC-protected path in the first place.

~/.dirac is already used by ensureSettingsDirectoryExists, ensureStateDirectoryExists, and ensureCacheDirectoryExists via getGlobalStorageDir(). Rules/Workflows/Hooks were the only outliers under ~/Documents.

Review follow-ups

• Nested Rules/Workflows/Hooks dirs migrate recursively (no EISDIR skip).
• HookRegistry.isGlobalHooksDir recognizes ~/.dirac/Hooks (and legacy Dirac/Hooks).
• Only expected legacy-path failures (ENOENT/EPERM/EACCES) are swallowed; unexpected errors (e.g. EIO, ENOSYS) are logged and rethrown so ensureDiracSubdir fails loudly instead of reporting success on incomplete migration.
• Coverage for nested migration, new global-hook path classification, EACCES, unexpected-error rejection, and per-file copy isolation.

Changes

src/core/storage/directoryEnsurers.ts

• ensureRulesDirectoryExists / ensureWorkflowsDirectoryExists / ensureHooksDirectoryExists resolve ~/.dirac/{Rules,Workflows,Hooks}.
• migrateDir + migrateFile: recursive migration with per-file isolation; destination files never clobbered.
• migrateFromDocumentsDir: swallows only expected legacy-path errors; logs and rethrows unexpected ones.

src/core/hooks/HookRegistry.ts

• isGlobalHooksDir matches both .dirac/Hooks and Dirac/Hooks.

Tests

• directoryEnsurers.test.ts — path resolution, creation, migration, idempotency, EPERM/EACCES, nested dirs, per-file isolation, unexpected-error rejection.
• HookRegistry.test.ts — legacy path, new .dirac path, workspace rejection.

Test plan

• directoryEnsurers.test.ts — 30/30 passing
• HookRegistry.test.ts — 3/3 passing
• biome on touched files — 0 new issues
• tsc unit-test project — only pre-existing src/shared/storage/types.ts baseline error

[dirac-run]

Requesting follow-up for three migration gaps:

1. Rules and workflows are loaded recursively, but this migration copies only immediate readdir entries. Nested directories hit EISDIR and are skipped, so nested global configuration stops loading after relocation.
2. HookRegistry.isGlobalHooksDir() recognizes .../Dirac/Hooks, but not the new .../.dirac/Hooks path. Relocated global hooks are therefore classified as workspace hooks.
3. The migration currently catches every read error and swallows every non-EEXIST copy failure, although only expected legacy-path failures such as ENOENT/EPERM should be ignored.

Please add coverage for nested migration and global-hook classification at the new path.

[dirac-run]

Follow-up needed:

One migration error-contract issue remains. migrateFromDocumentsDir() logs unexpected failures but then returns normally, so an EIO, ENOSYS, or similar failure from migrateDir() is still swallowed and ensureDiracSubdir() reports success despite an incomplete migration.

Please ignore only ENOENT/EPERM/EACCES; log and rethrow other errors. The unexpected-error test should expect rejection rather than successful completion.

[dirac-run]

One issue remains: migrateFromDocumentsDir() suppresses any escaping ENOENT/EPERM/EACCES, including errors from writing the new destination. A destination-side failure while creating a nested directory can therefore be swallowed and incomplete migration reported as success.

I’m merging this and will fix it forward before release by limiting expected-error suppression to legacy source reads, allowing destination failures to propagate, and adding regression coverage for destination permission failures.