fix(hooks): delegate the generated pre-commit hook to the runtime

[0xPlayerOne]

Closes #683.

Problem

The generated .githooks/pre-commit was a 53-byte whitespace guard:

#!/usr/bin/env sh
set -eu

git diff --cached --check

Meanwhile preCommit() — a language-aware gate for JS/TS, Rust, and Python —
already existed in src/runtime-core.mjs, reachable only through an argv
dispatch that nothing invoked:

if (/\.(js|jsx|ts|tsx|json|md|mdx|yml|yaml)$/.test(changed)) { ci('format'); ci('lint') }
if (/\.rs$|(^|\/)Cargo\.toml$/.test(changed))  { cargo fmt --check; cargo clippy -D warnings }
if (/\.py$|(^|\/)(pyproject\.toml|requirements[^/]*\.txt)$/.test(changed)) { ruff ... }

The template is the intended one, not drift: it is byte-identical to
package/.githooks/pre-commit, and sync --dry-run reports the consumer's
copy as already correct.

Every consumer committed ungated. Formatting, lint, and type errors were
discovered on CI instead.

Changes

The template delegates. It launches the CLI, which dispatches to
preCommit(). The whitespace check stays as an offline fallback so an
unavailable npx cannot block a commit.

preCommit() is exported so the CLI can reach it. runtime-core's argv
dispatch is now guarded by an entry-point check — without it, importing the
module for preCommit would run the gate a second time at import.

preCommit() runs ci('type_check'). It did format and lint but never
typecheck, though ci('type_check') already existed. Type errors were the
most common reason a green-looking commit failed CI later.

doctor can see this now. It asserted only that core.hooksPath was set,
so a correctly enabled but inert hook reported Repository doctor passed. It
now warns when the hook is missing or does not delegate.

Agent directories moved to the shared template. .zcode/, .kiro/, and
.goose/ were being added per repository; they now ship in
src/templates/gitignore so they are ignored once.

Verification

• 557 tests pass; lint, format, and type-check clean.
• Against a consumer repo with a staged unused import, the gate blocks the
  commit and prints the oxlint finding.
• doctor warns on the old template and on a missing hook, and stays silent
  on the new one.

Note on diagnosis

Worth recording, since it cost time here: code-foundry@1.33.0 contains no
mention of hooksPath, pre-commit, or githooks anywhere. Auditing a
consumer against an older CLI suggests hooks are unmanaged when they are in
fact generated. Pin the CLI to runtime_ref before auditing.

Follow-up

sync sources templates from the installed package root
(source: packageRoot), so consumers pick this up on the next release.