fix(cch): use exit code 2 to block tool calls per Claude Code hooks protocol

cch_cli/src/main.rs

@@ -250,6 +250,20 @@ async fn process_hook_event(cli: &Cli, _config: &config::Config) -> Result<()> {
     let debug_config = models::DebugConfig::new(cli.debug_logs, project_config.settings.debug_logs);
     let response = hooks::process_event(event, &debug_config).await?;
 
+    if !response.continue_ {
+        // Claude Code hooks protocol: exit code 2 BLOCKS the tool call.
+        // Only stderr is used as the error message and fed back to Claude.
+        // Exit code 0 with "continue":false only stops the conversation,
+        // it does NOT prevent the tool from executing.
+        let reason = response
+            .reason
+            .as_deref()
+            .unwrap_or("Blocked by CCH policy");
+        eprintln!("{}", reason);
+        std::process::exit(2);
+    }
+
+    // For allowed responses (with or without context injection), output JSON to stdout
     let json = serde_json::to_string(&response)?;
     println!("{}", json);