chore(tooling): migrate .githooks to lefthook.yml

WS-3 session 1a Task 1.

Lefthook installed as root dev-dependency with postinstall = lefthook
install. The two hand-rolled scripts in .githooks/ (post-commit,
pre-push) are dispatched 1:1 from lefthook.yml: each lefthook command
shells out to the existing .githooks/<hook> script. The script bodies
are kept as the source of truth because the bash logic (merge-commit
detection, .claude-sync.conf parsing, non-blocking pre-push warning)
would be lossy to translate into a YAML run: | block.

Active hook path moved from .githooks/ to .git/hooks/ via lefthook
install (core.hooksPath unset, git falls back to its default). The
.githooks/ directory is preserved and now documented as the
implementation invoked by lefthook plus an emergency rollback target
(README added).

Smoke-tested locally: the post-commit hook fires on every commit
(verified by reverted test commit). The pre-push hook fires on every
real push with new commits — manual `lefthook run pre-push` requires
`--force` because lefthook v2 skips when {push_files} is empty (see
lefthook.yml comment).

lefthook.yml

@@ -0,0 +1,31 @@
+# Lefthook configuration.
+#
+# Replaces the hand-rolled scripts that previously lived under
+# .githooks/ and were registered via `git config core.hooksPath
+# .githooks`. Behaviour is intentionally 1:1 with those scripts —
+# see WS-3 session 1a notes for the migration record.
+#
+# The .githooks/ scripts remain on disk and contain the actual logic
+# (gating against .claude-sync.conf, merge-commit handling, the
+# non-blocking pre-push warning). lefthook dispatches to them so the
+# delicate gating logic isn't re-translated into YAML. See
+# .githooks/README.md for details.
+
+post-commit:
+  commands:
+    sync-claude-docs:
+      run: bash .githooks/post-commit
+
+pre-push:
+  commands:
+    sync-check:
+      run: bash .githooks/pre-push
+      # Manual smoke tests need `lefthook run pre-push --force`:
+      # without `--force`, lefthook v2 inspects {push_files} (the
+      # diff between local and remote) and skips when that list is
+      # empty, which is always the case during a manual run. On a
+      # real `git push` with commits the file list is non-empty and
+      # the command fires — matching the legacy hook's "always runs"
+      # behaviour. (Pushing with zero new commits would be skipped
+      # under lefthook but is a no-op for the sync-staleness warning
+      # anyway, so behaviour stays effectively 1:1.)