Add local pre-push gates so PRs are not opened on a red check

[TheGreatAxios]

Fixes https://linear.app/abklabs/issue/CL-7188/add-local-pre-push-gates-so-prs-are-not-opened-on-a-red-check

bun install / bun run hooks:install sets core.hooksPath to a repo-local pre-push hook that runs lint, typecheck, and unit tests (the cheap CI jobs). Walking-skeleton / e2e / database-backed suites stay on GitHub.

Override with git push --no-verify or SKIP_WORKBENCH_HOOKS=1. Seed and automation git writes keep isolating hooks so this cannot re-block credential seed.

[TheGreatAxios]

Reviewed against CL-7188's acceptance criteria and did a full pass on the diff, CI, and the git-hooks mechanics.

Verified against acceptance criteria — all satisfied:

• bun install / bun run hooks:install sets a repo-local core.hooksPath pre-push hook that runs lint, typecheck, and unit tests; no husky.
• The hook explicitly skips walking-skeleton/e2e/database suites; confirmed those stay CI-only.
• Force override (git push --no-verify or SKIP_WORKBENCH_HOOKS=1) is documented in CONTRIBUTING.
• CONTRIBUTING's short version calls out the pre-push/CI split.
• Seed/automation git writes (packages/hub-client/src/workflow-push.ts) already isolate hooks via git -c core.hooksPath=, independent of this change, so credential seed stays unblocked.

Drift check — the hook runs exactly bun run lint, bun run typecheck, bun run test, which match the lint, typecheck, and build-test CI jobs' own commands (minus bun run build, which the acceptance criteria doesn't ask the local gate to cover). No mismatch between what's gated locally and what CI checks.

Fixed: the PR description referenced a stale env var name (WORKBENCH_SKIP_PRE_PUSH) that doesn't match the implemented SKIP_WORKBENCH_HOOKS. Updated the description to match the code/CONTRIBUTING.md.

No code changes needed — lint, typecheck, and the new hooks-install.test.ts suite (8/8) all pass clean. One unrelated local-only test failure surfaced while running the full check suite, in packages/tool-registry-publish's freshness-check tests — traced it to a personal machine-wide git hook (~/.config/git/hooks, an author allowlist) blocking the test's synthetic git commits. Reproduces identically on main, untouched by this PR, and doesn't exist in CI (GitHub Actions' build-test job is green), so it's not a regression from this change.

No open review comments to address. Looks ready to merge.

[TheGreatAxios]

Cross-PR dependency, flagged so it is not discovered at merge time.

PR #503 (CL-7226) moves the workspace onto TypeScript project references and tsc --build, and as part of that deletes scripts/affected.ts and the WORKBENCH_CHECK_SINCE env var, including its CI wiring on both the typecheck and test jobs.

The pre-push hook this PR adds sets WORKBENCH_CHECK_SINCE. Whichever of these two merges second needs to drop that line — if this one lands after #503, the hook will set an env var nothing reads any more, which is the sort of dangling reference that quietly misleads whoever reads it next.

Worth noting the numbers, because they change the calculus for this PR's own design: #503 takes a cold typecheck from over 600s (past the command cap) to roughly 110-118s, with a warm no-op around 56s. The concern raised in review here — that a gate nobody can afford to wait for gets bypassed with --no-verify — is largely answered by that. The CONTRIBUTING.md note added here about the global-path fallback triggering a slow full run should be re-checked against the post-#503 behaviour rather than carried over unchanged.

No action needed on this PR right now; recording the ordering.