build: add commit hooks

lefthook.yml

@@ -0,0 +1,22 @@
+# Commit checks. Generated by project-bootstrap; coding agents may not edit it.
+# Remove the sections for languages the project doesn't use.
+# Formatter (biome) intentionally not enforced repo-wide: the codebase is
+# pre-existing, unformatted (spaces), and has no config — it gets formatted
+# file by file as files are touched, not in a mass reformat.
+pre-commit:
+  parallel: true
+  commands:
+    gitleaks:
+      run: gitleaks git --pre-commit --staged --no-banner --redact
+    large-files:
+      run: .githooks/check-large-files.sh {staged_files}
+
+    # --- shell ---
+    shellcheck:
+      glob: "*.sh"
+      run: shellcheck {staged_files}
+
+commit-msg:
+  commands:
+    conventional:
+      run: .githooks/commit-msg-check.sh {1}