Guard installs when hooks path is external

[nshkrdotcom]

Summary

• Skip installation when the resolved hooks path is outside the repo unless explicitly allowed.
• Add allow_external_hooks_path config + GIT_HOOKS_ALLOW_EXTERNAL env override.
• Add install tests for external hooks path + opt-in.
• Keep tests warning-free by avoiding deprecated MFA.new/3 in core code and silencing git init hints.

Testing

• mix test