chore: pre-commit hook stack (ruff, gitleaks, commitizen, mypy, hygiene)

[constk]

Problem

Even with CI gates configured, contributors (human and LLM) routinely push commits that break the gates. Pre-commit catches the violation locally before the push, saving CI minutes and review cycles.

Proposed solution

Port .pre-commit-config.yaml from Teller verbatim: ruff (lint+format auto-fix), generic hooks (YAML/TOML/JSON parse, merge conflicts, large files >500 KB, whitespace, EOF, LF), gitleaks (secret scan), commitizen (commit-msg stage), and a local mypy hook running uv run --frozen mypy --strict.

Acceptance criteria

• pre-commit install wires commit-msg + pre-commit hooks.
• pre-commit run --all-files exits 0 on the empty scaffold.
• Gitleaks blocks a contrived AWS-key staged file in a manual smoke test.
• Commitizen rejects a commit message starting with wip: (not in the 7-prefix schema).
• Documented in docs/DEVELOPMENT.md (ticket docs: HARNESS, INVARIANTS, BOUNDARIES, DEVELOPMENT, EVAL_HARNESS, SECURITY, ARCHITECTURE skeletons #25) — note dependency.

Priority rationale

Critical: secrets leaked once cannot be unleaked. Pre-commit gitleaks is the cheapest first line of defence.

Depends on

#2

[constk]

Auto-close did not fire from the squash-merge body. Marking closed retrospectively — the work shipped weeks ago and the project board's Done column reflects the actual state once the project-item move that follows this comment lands.