ci(ai-tutors): add prek hook enforcing inject-knowledge-base.py --check

[dpol1]

Summary

• Nothing ran python3 ai-tutors/inject-knowledge-base.py --check, so a
  docs/education/ source-page edit could leave the generated tutor prompts
  in ai-tutors/ silently stale — both shipped prompts had already drifted
  this way before being noticed (see the issue for the history).
• Wire --check as a local prek hook scoped to
  ^(ai-tutors/|docs/education/), mirroring the vendor-neutrality-score
  hook's generated-content pattern (own repo: local block,
  pass_filenames: false, explanatory comment). The script itself is
  untouched — --check already prints the drifting prompts and exits
  non-zero.
• CI already runs prek run --all-files, so the one config change gates both
  commit time and CI.

Type of change

• CI / dev loop (prek, workflows, validators)

Test plan

• Red case: with the drift currently live on main
  (ai-tutors/lesson-08-eval-driven-development.md), the hook fails and
  names the stale file.
• Green case: after regenerating lesson-08 locally, the hook passes.
  (The regeneration itself is not part of this PR — see the ordering note
  below.)
• prek run --files .pre-commit-config.yaml passes, including the
  "Check if all hooks apply to the repository" gate that validates the
  new files: pattern.

RFC-AI-0004 compliance

CI-only; no principles touched.

Linked issues

Closes apache/magpie#1051

Notes for reviewers

Ordering: blocked by apache/magpie#1050.
main currently has a live lesson-08 drift, which #1050 fixes. Until that
merges, this PR's own CI will fail on exactly the new hook — a live
demonstration that the gate works, but it means this PR should merge
after #1050 (and then rebase/re-run to go green). Regenerating lesson-08
here instead would duplicate #1050, so this PR deliberately stays hook-only.