chore: organize justfile into groups and switch devshell to prek

[tembleking]

Justfile recipes were flat and hard to scan; grouping them makes just --list navigable as the recipe set grows. Also hardens the release path and modernizes the local hooks tooling.

• Recipes grouped by intent (build, format, dev, update) via [group(...)].
• release now depends on format-check and prompts for confirmation, so a spotless failure or a stray invocation aborts before touching the release lifecycle. Tests aren't re-run since release:prepare already does.
• Short flags in the bash recipes expanded to long form for readability.
• Devshell swaps pre-commit for prek and installs with --overwrite on entry, making the hook install idempotent and fixing the stale nix-store hook path that broke commits.
• Added check-json, detect-private-key, and mixed-line-ending --fix=lf hooks for basic safety and consistency.