Under the hood
Hook commands can now optionally be run through a sandboxed execution wrapper before they start
What
The internal function that runs hook commands now accepts an extra parameter that can optionally acquire a sandboxed executable resource before starting the hook process. If that sandboxed resource can't be obtained, the hook is now treated as having failed to spawn, rather than running normally.
Why
This lets hook commands be run inside a sandbox when needed, and ensures that if the sandbox can't be set up, the hook fails safely instead of running outside the sandbox unexpectedly.