Fix stale removal comments (persistent, not destroy) + add deterministic install test

- The remove_* comments still described the superseded "disable -> drain -> destroy"
  flow; the code keeps hooks alive (persistent) and re-enables on re-install. Updated
  the comments to match, and corrected the XInput note (its detours return synthesized
  state and never call the trampoline, so destroying its vector is safe -- unlike the
  trampoline-calling present/MKB/focus-cursor hooks).
- hook_install_test: a fast, single-threaded contract test for hook_install.hpp --
  install_inline creates the hook once and reuses the SAME trampoline across 50
  install/remove cycles (never freed -> no stale-detour UAF), toggling enable/disable
  cleanly. Fills the guard the removed (flaky, concurrency-bound) reproducer left, with
  no threads so it can't flake on SafetyHook's enable/disable atomicity.

x64 23/23, x86 3/3.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hook/src/xinput_hook.cpp

@@ -237,10 +237,10 @@ bool install_xinput_hooks(IpcClient& ipc)
 
 void remove_xinput_hooks()
 {
-	// Disable (restore original bytes) first so no new detour starts, but KEEP the trampolines alive
-	// for any in-flight detour calling its trampoline; destroy only after the drain. Clearing the
-	// vector here would free the trampolines immediately -- a UAF a game polling XInput at a high
-	// rate could hit (the same class as the mock-game present-storm crash).
+	// Disable (restore original bytes) first so no new detour starts, then drain in-flight detours
+	// before nulling the IPC pointer they read. The XInput detours return synthesized pad state and
+	// never call the trampoline, so (unlike the present/MKB hooks) destroying the vector after the
+	// drain is safe -- there's no live trampoline a stale detour could jump through.
 	for (auto& h : g_hooks)
 	{
 		disable_for_removal(h);