Per-subsystem hook control: install/remove input, focus, audio at runtime

Add a host->hook control channel (protocol v5 -> v6: HookControl in SharedBlock,
per-subsystem "disabled" flags, 0 = install so the zero-filled default is
unchanged). The worker now reconciles each subsystem every tick: install what's
requested-and-missing, remove what's no longer wanted -- so the audio hooks
re-attach the ring and republish format on a reinstall, and XInput/focus clear
their stale status flags on removal.

Injection panel: a checkbox per subsystem (input forwarding / focus spoof /
audio render-hook) toggles it at runtime, showing the requested vs actual
installed state from the registry, plus DLL heartbeat liveness. The hook-status
section now keys off whether a DLL was injected (host-side) rather than the
input-hook "attached" flag, so it stays visible with input unhooked.

Guards for dependent features: the synthetic-input control is disabled when
input forwarding is off, and the Audio panel explains that mirroring uses
loopback (echo) when the render-hook is off.

Verified against Phantom Brave via coop_audio_probe: starting with audio
requested off installs only input+focus (8 hooks, no capture); re-enabling at
runtime installs the audio hooks (13) and capture starts immediately. All four
tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -117,6 +117,14 @@ Done:
   reported over IPC. The Injection panel shows it grouped by subsystem
   (input / focus / audio) so you can see exactly what's hooked and how busy each
   hook is. `coop_audio_probe` prints the same table headless.
+- **Per-subsystem hook control. ✅** The three injectable subsystems — input
+  forwarding (XInput), focus spoof, and the audio render-hook — are independently
+  controllable. The Injection panel has a checkbox per subsystem that
+  installs/removes its hooks at runtime over a host→hook control channel; the hook
+  reconciles each tick. Dependent features are guarded: the synthetic-input
+  control is disabled when input forwarding is off, and the Audio panel notes when
+  the render-hook is off (mirroring then uses loopback). Defaults to all-on so
+  behavior is unchanged unless you toggle something.
 
 Future work, roughly in priority order: