feat(precommit): shared layer for org-wide pre-commit (configs + templates)

[JacobPEvans-personal]

Summary

Stand up precommit/ as the single canonical home for pre-commit configuration shared across every dryvist repo. Two consumption paths share the same artifacts:

• Nix-flake repos — imports = [ inputs.nix-devenv.flakeModules.<profile> ] (terraform / ansible / python / base). Pinned via flake.lock. The profile modules ship in dryvist/nix-devenv PR #34.
• Non-Nix repos — copy templates/<profile>.yaml at scaffold + materialize the canonical lint configs from configs/. Renovate keeps rev: pins fresh going forward.

README.md row added to the inheritance-mechanism + API tables. Full architecture doc at precommit/README.md.

What's in this PR

precommit/configs/ — canonical lint configs for tools that demand a file on disk

File	Source variant	Notes
tflint.hcl	terraform-proxmox / terraform-github (shared canonical)	Terraform plugin recommended preset + 4 documentation-discipline rules. AWS/GCP/Azure plugins stay opt-in per repo.
ansible-lint.yml	ansible-proxmox	Production profile + fqcn + no-changed-when, skip yaml[line-length], exclude SOPS-encrypted + cache dirs.
yamllint.yml	ansible-proxmox	line-length 160 warn, octal forbidden, comments-indentation off (ansible-lint compat).

precommit/templates/ — static .pre-commit-config.yaml fragments for non-Nix consumers

Template	Includes
base.yaml	check-yaml/toml/json/merge-conflict, large-files (500kb), end-of-file-fixer, trim-trailing-whitespace, detect-private-key, markdownlint-cli2, zizmor
terraform.yaml	base + terraform_fmt + terraform_validate + terraform_tflint + terraform_docs
ansible.yaml	base + ansible-lint + yamllint
python.yaml	base + ruff + ruff-format + mypy

Hook versions pinned: pre-commit-hooks v6.0.0, pre-commit-terraform v1.92.0, ansible-lint v26.4.0, yamllint v1.38.0, markdownlint-cli2 v0.22.1, zizmor v1.25.2. Renovate sync for these tracked separately.

Canonical-config strategy

• Each merged config picks the most-common variant from the workspace inventory rather than the strictest superset, to keep Phase 2 consumer migrations from becoming massive cleanups.
• The markdownlint canonical (.markdownlint-cli2.yaml) stays at the .github root for backwards compat with the existing markdownlint workflow — precommit/templates/*.yaml fetch it from there.
• terragrunt-validate / terragrunt-plan are NOT included anywhere per the terraform-checks-placement policy (CI-only via OIDC). terraform_docs IS in the template per the same policy.
• checkov (terraform) / bandit / detect-secrets are opt-in per repo — they have high false-positive rates or dominate the hook cycle and didn't earn a seat in the canonical based on inventory.

Test plan

• CI green
• Diff precommit/configs/tflint.hcl against terraform-proxmox / terraform-github source to confirm canonical merge (no rules lost)
• Diff precommit/configs/ansible-lint.yml against ansible-proxmox source to confirm canonical merge
• Diff precommit/configs/yamllint.yml against ansible-proxmox source to confirm canonical merge
• After this lands, follow-up PR in dryvist/nix-devenv wires lib/fetch-shared-configs.nix so the Nix profile modules materialize these configs into each repo via shellHook
• First Phase 2 trial migration: adopt flakeModules.terraform + delete .pre-commit-config.yaml in terraform-runs-on

Architecture context

Phase 1b of the shared pre-commit rollout. Pairs with dryvist/nix-devenv PR #34 (Phase 1a — profile modules). Phase 2 migrates ~16 Nix-flake consumer repos to the single-import pattern. Phase 3 locks the convention in agentsmd/rules/pre-commit.md + a CI guard reusable workflow.

Refs: dryvist/nix-devenv#34

Assisted-by: Claude noreply@anthropic.com