Add pre-commit hook to reject lock files from non-project package managers

[trillium]

Overview

PRs occasionally include lock files from package managers the project doesn't use (e.g. package-lock.json when the project uses Yarn). This causes confusion and bloats diffs. A pre-commit hook should reject these artifacts automatically.

Action Items

• Add a pre-commit hook (e.g. via Husky) that checks for package-lock.json and pnpm-lock.yaml in staged files
• If detected, reject the commit with a message explaining the project uses Yarn and to run yarn install instead
• Add the hook setup to the project's dev dependencies if Husky is not already configured
• Consider adding package-lock.json and pnpm-lock.yaml to .gitignore as a secondary safeguard

Resources/Instructions

• Husky - Git hooks
• lint-staged for running checks on staged files
• Motivated by PR Migrate backend from CommonJS to ES Modules #2134 where package-lock.json was accidentally introduced during the ESM migration