Fix stale removal comments (persistent, not destroy) + add deterministic install test

- The remove_* comments still described the superseded "disable -> drain -> destroy"
  flow; the code keeps hooks alive (persistent) and re-enables on re-install. Updated
  the comments to match, and corrected the XInput note (its detours return synthesized
  state and never call the trampoline, so destroying its vector is safe -- unlike the
  trampoline-calling present/MKB/focus-cursor hooks).
- hook_install_test: a fast, single-threaded contract test for hook_install.hpp --
  install_inline creates the hook once and reuses the SAME trampoline across 50
  install/remove cycles (never freed -> no stale-detour UAF), toggling enable/disable
  cleanly. Fills the guard the removed (flaky, concurrency-bound) reproducer left, with
  no threads so it can't flake on SafetyHook's enable/disable atomicity.

x64 23/23, x86 3/3.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hook/src/mkb_hook.cpp

@@ -515,11 +515,11 @@ void remove_mkb_hooks()
 		return;
 	}
 	g_active.store(false, std::memory_order_release);
-	// Disable (restore original bytes) the inline hooks first so no new detour starts, but KEEP the
-	// trampolines alive for any in-flight detour calling its trampoline; destroy only after the
-	// drain. Destroying before the drain frees the trampoline under a detour about to call it -- the
-	// same UAF class as the present-storm crash. (The DI hook is a vtable swap: remove() restores the
-	// slot and keeps m_original valid, so it has no trampoline to free early.)
+	// Disable (restore original bytes) the inline hooks so no new detour starts, KEEPING the
+	// trampolines alive for any in-flight detour calling its trampoline (persistent model -- never
+	// destroyed during the session; re-install re-enables, see hook_install.hpp). Destroying would
+	// free a trampoline under a detour about to call it -- the present-storm UAF class. (The DI hook
+	// is a vtable swap: remove() restores the slot and keeps m_original valid, no trampoline either.)
 	disable_for_removal(g_hk_async);
 	disable_for_removal(g_hk_kbstate);
 	disable_for_removal(g_hk_cursor);