chore(devex): install a make check pre-push hook via make setup (backend#1606)

[LukasWodka]

What

Step 4 of #1606, fanned out to client. make setup now installs a git pre-push hook that runs make check; factored into a standalone install-hooks target. Mirrors the merged reference e2e-test-agent#46.

Design (honest by construction)

• Catches forgetting, not defiance: git push --no-verify always skips it.
• Won't clobber a foreign pre-push hook — it declines and says so.
• Worktree/submodule-safe via git rev-parse --git-path hooks.

Test plan

Mirrors #46 (verified end-to-end there). Here: make -n install-hooks and make help parse cleanly.

Parent epic: #1680.

---

Note

Low Risk
Makefile-only developer workflow change; no runtime, auth, or deployment behavior is affected.

Overview
make setup now installs a git pre-push hook that runs make check, so fast lint/drift/helm checks run before pushes without relying on contributor memory.

A new install-hooks target writes the hook (also invoked from setup). The hook is worktree/submodule-safe via git rev-parse --git-path hooks, refuses to overwrite an existing non-tracebloc pre-push hook, and unsets GIT_* env vars in the hook so nested git (e.g. Go buildvcs) does not fail in linked worktrees. help and header comments document install-hooks and git push --no-verify as the escape hatch.

^{Reviewed by Cursor Bugbot for commit ce2dbbd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[aptracebloc]

@LukasWodka — Approved. Verified the hook behavior end-to-end on GNU Make 3.81 / macOS (the portability floor).

• make install-hooks writes an executable .git/hooks/pre-push running make check; make setup wires it in.
• Clobber-safe: with a foreign pre-push hook present, the target declines and leaves it byte-for-byte untouched (marker-based detection); idempotent over its own hook.
• Degrades gracefully outside a checkout (exit 0); --no-verify escape hatch documented in the hook, setup, help, and header.
• Failure propagates: forced an unwritable hooks dir → make Error, no false "installed" (the earlier ;→&& Bugbot fix, confirmed working). No unresolved Bugbot findings; root Makefile isn't code-owned.

Two Low nits only (marker substring-match could false-positive a hook literally containing the marker text; hook assumes make on PATH at push time) — neither worth changing.

🤖 Generated with Claude Code