fix(git-hooks): canonical polish from org-wide review

Three related fixes across pre-push and commit-msg, uncovered by
gemini/coderabbit review on crates#47, crates#48, dev#4, npm#31:

- pre-push: guard the force-push loop with [ -n "$PUSH_REFS" ] and skip
  iterations with empty local_sha. Previous here-doc refactor fed a
  trailing newline through the loop, causing `git merge-base` to fire
  with empty args and falsely reject pushes without ref input.

- commit-msg: move the WIP/fixup/squash guard *before* the format check
  so a user on main gets the branch-specific "WIP not allowed on main"
  message instead of the generic "Invalid format" error. Previously dead
  code because WIP messages never matched the Conventional Commits regex.

- commit-msg: tighten the ticket-prefix regex from [A-Z]+ to [A-Z]{2,}
  for consistency with prepare-commit-msg, which only prepends 2+ char
  prefixes. Also mention the Conventional Commits ! marker in the error
  hint so users know `feat!:` is accepted.

Propagates to crates templates + npm via the open PRs rebasing or
re-syncing from this baseline.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: WomB0ComB0

scripts/git-hooks/commit-msg

@@ -13,28 +13,33 @@ INPUT_FILE="${1:-}"
 PATTERN="^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?(!)?: .+$"
 
 FIRST_LINE=$(head -1 "$INPUT_FILE")
-SUBJECT=$(sed 's/^\[[A-Z][A-Z]*-[0-9]*\][[:space:]]*//' <<<"$FIRST_LINE")
-
-if ! grep -qE "$PATTERN" <<<"$SUBJECT"; then
-    echo "Error: Invalid commit message format."
-    echo "Expected: type(scope): subject"
-    echo "Examples:"
-    echo "  feat(core): add new feature"
-    echo "  fix(ui): fix button color"
-    exit 1
-fi
+# Ticket-prefix regex matches what prepare-commit-msg prepends ({2,} chars).
+SUBJECT=$(sed -E 's/^\[[A-Z]{2,}-[0-9]+\][[:space:]]*//' <<<"$FIRST_LINE")
 
+# WIP / fixup! / squash! guard runs *before* the format check so users get
+# a branch-specific error message on main/master instead of the generic
+# "Invalid commit message format".
 BRANCH=$(git symbolic-ref --short HEAD 2>/dev/null || echo "")
 case "$BRANCH" in
     main|master)
-        if grep -qiE "^(\[[A-Z]+-[0-9]+\] )?(fixup!|squash!|wip[: ])" <<<"$FIRST_LINE"; then
+        if grep -qiE "^(\[[A-Z]{2,}-[0-9]+\] )?(fixup!|squash!|wip[: ])" <<<"$FIRST_LINE"; then
             echo "Error: fixup!/squash!/WIP commits are not allowed on $BRANCH."
             echo "Create a feature branch instead."
             exit 1
         fi
         ;;
 esac
 
+if ! grep -qE "$PATTERN" <<<"$SUBJECT"; then
+    echo "Error: Invalid commit message format."
+    echo "Expected: type(scope)(!): subject"
+    echo "Examples:"
+    echo "  feat(core): add new feature"
+    echo "  feat!: remove deprecated API  (breaking change marker)"
+    echo "  fix(ui): fix button color"
+    exit 1
+fi
+
 LOCAL_HOOK="$(git rev-parse --show-toplevel)/.git-hooks/local-commit-msg"
 if [ -x "$LOCAL_HOOK" ]; then
     exec "$LOCAL_HOOK" "$@"

scripts/git-hooks/pre-push

@@ -25,18 +25,24 @@ fi
 # ── Force-push guard on main/master ─────────────────────────────────────────
 case "$BRANCH" in
     main|master)
-        while read -r _local_ref local_sha _remote_ref remote_sha; do
-            if [ "$remote_sha" != "0000000000000000000000000000000000000000" ] && \
-               [ "$local_sha"  != "0000000000000000000000000000000000000000" ]; then
-                if ! git merge-base --is-ancestor "$remote_sha" "$local_sha" 2>/dev/null; then
-                    echo "❌ Force push to $BRANCH is not allowed."
-                    echo "   Override with:  git push --no-verify"
-                    exit 1
+        # Only iterate when git actually gave us refs — an empty $PUSH_REFS
+        # would otherwise feed one blank line through the heredoc and trip
+        # the guard.
+        if [ -n "$PUSH_REFS" ]; then
+            while read -r _local_ref local_sha _remote_ref remote_sha; do
+                [ -z "$local_sha" ] && continue
+                if [ "$remote_sha" != "0000000000000000000000000000000000000000" ] && \
+                   [ "$local_sha"  != "0000000000000000000000000000000000000000" ]; then
+                    if ! git merge-base --is-ancestor "$remote_sha" "$local_sha" 2>/dev/null; then
+                        echo "❌ Force push to $BRANCH is not allowed."
+                        echo "   Override with:  git push --no-verify"
+                        exit 1
+                    fi
                 fi
-            fi
-        done <<EOF
+            done <<EOF
 $PUSH_REFS
 EOF
+        fi
         ;;
 esac