Function recommend_hook_mode 

pub fn recommend_hook_mode(agent_key: &str) -> HookMode

Auto-detect the best hook mode for a given agent key.

Priority: disabled/shadow_mode cap > config override > Replace > Hybrid > Mcp

• Replace: native tools denied, MCP-only path (zero tool drift)
• Hybrid: MCP + shell hooks (fallback for agents without deny support)
• Mcp: MCP server only (no shell hooks available)

LEAN_CTX_DISABLED=1 or shadow_mode = false cap the mode at Hybrid so the deny-list is never injected when the user opted out (#1037).