Add lefthook git hooks with a vendor-manifest guard

pre-commit: ESLint --fix on staged files (vendored source excluded),
incremental typecheck, and the vendor-manifest guard — any staged
change under vendor/*/src must be accompanied by a vendor/README.md
update in the same commit, mechanizing the local-modification log
discipline. pre-push: tests + hygiene (knip/publint/constraints).
Hooks call the same package.json scripts CI runs (single source of
truth); installed automatically via postinstall.

lefthook.yml

@@ -0,0 +1,29 @@
+# Git hooks (lefthook). Hooks call the same package.json scripts CI runs —
+# one source of truth; the hook is just an earlier, faster checkpoint.
+# Install: `yarn lefthook install` (runs automatically via postinstall).
+
+pre-commit:
+  parallel: true
+  jobs:
+    - name: lint (staged)
+      glob: '*.{ts,mts,cts,mjs}'
+      exclude:
+        - 'vendor/*/src/**'
+      run: node_modules/.bin/eslint --fix {staged_files} && git add {staged_files}
+      stage_fixed: true
+
+    - name: typecheck
+      glob: '*.ts'
+      run: yarn typecheck
+
+    - name: vendor manifest guard
+      run: scripts/check-vendor-manifest.sh
+
+pre-push:
+  parallel: true
+  jobs:
+    - name: test
+      run: yarn test
+
+    - name: hygiene
+      run: yarn hygiene