Dev: Use Lefthook for git hooks (instead of Husky)

[evans-sam]

Problem

#26 spec'd Husky + lint-staged for pre-commit hooks. Lefthook is a better fit for this project:

• Single Go binary; no Node-spawn-per-hook overhead.
• Parallel command execution out of the box.
• Single lefthook.yml config — built-in glob filtering, no separate lint-staged package.
• No postinstall script required.
• Two devDependencies (husky + lint-staged) collapse to one (lefthook).

Why it matters

Hook latency directly affects commit friction; faster hooks mean contributors keep them enabled. Smaller dev surface area also helps #14 (audit-in-CI) and Dependabot churn.

Trade-offs

• Lefthook is less ubiquitous than Husky. Contributors may need a one-line README pointer.
• Initial install pulls a platform-specific binary (similar weight to Husky's setup).

Proposed approach

1. npm install --save-dev lefthook.
2. Add lefthook.yml:

   pre-commit:
     parallel: true
     commands:
       format:
         glob: "*.{ts,js,json,md,yml}"
         run: npx prettier --write {staged_files} && git add {staged_files}
       lint:
         glob: "*.ts"
         run: npx eslint --fix {staged_files} && git add {staged_files}

   If Dev: Migrate from ESLint + Prettier to Biome #31 (Biome migration) lands first, collapse both commands to:

   check:
     glob: "*.{ts,js,json,jsonc}"
     run: npx biome check --write {staged_files} && git add {staged_files}

3. Document npx lefthook install (one-time per clone) in CONTRIBUTING.md. CI does not need it.
4. Drop the husky + lint-staged plan from Dev: Add Husky + lint-staged pre-commit hook #26.

Coordination

• Supersedes the Husky portion of Dev: Add Husky + lint-staged pre-commit hook #26. This issue owns the hook framework; Dev: Add Husky + lint-staged pre-commit hook #26 still owns the spec for what runs inside the hook (formatting + lint).
• Dev: Migrate from ESLint + Prettier to Biome #31 (Biome migration): if Biome lands first, Lefthook commands call biome check --write instead of separate eslint + prettier.

Acceptance criteria

• lefthook in devDependencies. No husky, no lint-staged.
• lefthook.yml present and committed.
• CONTRIBUTING.md documents npx lefthook install and --no-verify bypass.
• Committing a badly-formatted file triggers the hook.
• Hook runs in parallel (verifiable via lefthook run pre-commit --verbose).