fix: Windows path support, error handling, and dedup in validators

- session-manager.js: fix getSessionStats path detection to handle
  Windows paths (C:\...) in addition to Unix paths (/)
- package-manager.js: add try-catch to setPreferredPackageManager for
  consistent error handling with setProjectPackageManager
- validate-hooks.js: extract duplicated hook entry validation into
  reusable validateHookEntry() helper
- Update .d.ts JSDoc for both fixes

scripts/lib/session-manager.js

@@ -146,12 +146,14 @@ function parseSessionMetadata(content) {
  */
 function getSessionStats(sessionPathOrContent) {
   // Accept pre-read content string to avoid redundant file reads.
-  // If the argument looks like a file path (no newlines, ends with .tmp),
-  // read from disk. Otherwise treat it as content.
-  const content = (typeof sessionPathOrContent === 'string' &&
+  // If the argument looks like a file path (no newlines, ends with .tmp,
+  // starts with / on Unix or drive letter on Windows), read from disk.
+  // Otherwise treat it as content.
+  const looksLikePath = typeof sessionPathOrContent === 'string' &&
     !sessionPathOrContent.includes('\n') &&
-    sessionPathOrContent.startsWith('/') &&
-    sessionPathOrContent.endsWith('.tmp'))
+    sessionPathOrContent.endsWith('.tmp') &&
+    (sessionPathOrContent.startsWith('/') || /^[A-Za-z]:[/\\]/.test(sessionPathOrContent));
+  const content = looksLikePath
     ? getSessionContent(sessionPathOrContent)
     : sessionPathOrContent;