🔧 chore: unify git hooks in .githooks/ — one location, no hand-copied duplicates

[flupkede]

What

All git hooks now live in .githooks/ and are enabled by a single setting:

git config core.hooksPath .githooks

No more copying files into .git/hooks/.

Why

Two independent traps, both of the same shape — an instruction that silently disables a guard:

• scripts/pre-push documented its own install as cp scripts/pre-push .git/hooks/pre-push, but the tracked copy had no customer-reference leak scan. Following the documented install silently removed that guard.
• .githooks/post-checkout documented git config core.hooksPath .githooks, which would have made git look only in .githooks/ — a directory holding neither pre-commit nor pre-push. Enabling one hook would have disabled the two that matter. core.hooksPath was in fact unset, so post-checkout had never run at all.

Changes

• .githooks/{pre-commit,pre-push,post-checkout} + README.md. scripts/pre-commit and scripts/pre-push deleted; scripts/qc.ps1 stays.
• Customer patterns move to untracked, gitignored .githooks/customer-patterns.local. The list is the thing being hidden, so it must never be tracked.
• One rule for the scan: configuration problems warn, actual leaks block. A missing file, an empty file, or a pattern that makes git grep fail all print a loud SKIPPED — nothing was checked banner and let the push through. A guard that stops running quietly is worse than no guard, because it is still trusted.
• pre-push skips the Rust QC gate when the branch changes no Rust. Compared against origin/develop rather than the pushed ref range — stdin is already consumed by the master guard, and this avoids the all-zeros remote_sha case for a new branch. Every uncertain case runs the gate.
• Leak scan uses git grep -lIE instead of git ls-files | xargs grep: space-safe paths, no ARG_MAX limit, no stderr to suppress.
• ci.yml: add chore/** to the push allowlist — the same prefix-allowlist footgun that left fix/** with no CI at all until 🐛 fix: stop waking the scale-to-zero federated peer (and stop it self-warming afterwards) #192.
• RELEASING.md no longer documents the cp install; README.md's hooks git install paragraph corrected (it resolves the target via git rev-parse --git-path hooks, so it already honours core.hooksPath).

The master-push guard is functionally unchanged.

Verification

The hook was run directly against a throwaway repo, not just read:

Case	Result
Push to master (incl. delete, HEAD:master, multi-ref)	blocked, exit 1
Normal branch push	exit 0, QC skipped, scan clean
Pattern file missing / empty	loud SKIPPED, exit 0
Invalid regex in pattern file, real leak present	loud SKIPPED, exit 0 — previously reported "clean"
Planted customer reference in a tracked file	blocked, exit 1
rust-toolchain.toml, .cargo/, scripts/qc.*, *.rs, Cargo.*	gate runs
Docs-only paths	gate skipped

This PR's own push exercised it end to end: QC correctly skipped, leak scan ran clean.

Two review rounds. Round 1 raised three Important findings — a || true that turned a git grep failure into a clean pass, a stale cp instruction in RELEASING.md, and a QC-skip regex that missed rust-toolchain.toml and .cargo/. All three were fixed and amended into the single commit; round 2 passed with nothing new.

Follow-up (not in this PR)

.claude/commands/merge.md still describes the pre-commit hook as bumping the patch version and rebuilding the binary. That stopped being true before this branch — the bump is now CI-side on PR merge. Its /merge guardrail aborts on chore/* on that false premise, so it would refuse this very branch. Left alone deliberately: correcting it means changing merge-workflow behaviour, which deserves its own PR.