chore: install pre-commit/pre-push git hooks

[PenguinzTech]

Summary

• Repo had no .pre-commit-config.yaml, no install-hooks target, no hooks at all — every commit was completely ungated.
• Adds the standard PenguinTech pre-commit framework: gitleaks, shellcheck, ruff (+ruff-format), hadolint, actionlint, plus hygiene fixers at commit time; bandit + Dockerfile-rootless check at push time.
• Adds make install-hooks / make verify-hooks; make setup now depends on install-hooks.
• Adds canonical [tool.ruff] block in a new root pyproject.toml (repo has no packageable root pyproject.toml — config-only, target-version = "py313" matching the 89/90 Dockerfiles on python:3.13).
• Replaces a stale husky snippet in docs/hub_module/TESTING.md (husky is unused anywhere in this org, contradicts devops.md) with the make install-hooks flow.

Notable findings (not fixed here — out of scope for a hooks-only PR)

Finding	Detail
verify() worktree bug (fixed in this PR)	scripts/install-pre-commit.sh's verify() resolved hooks via "$(git rev-parse --show-toplevel)/.git/hooks/<hook>". Inside a linked worktree .git is a file, not a directory, so this always false-negatived. Fixed to resolve via git rev-parse --git-common-dir. Same bug exists in admin/scripts/install-pre-commit.sh — worth porting upstream.
shared/py_libs duplication — does not exist on v2.2.x	The task brief flagged shared/py_libs/pyproject.toml vs shared/shared/py_libs/pyproject.toml as an apparent duplicate. That's true on main/chore/add-codeowners, but v2.2.x (this PR's base) already migrated shared/ entirely to published penguin-libs packages (commit a0b5c315) — there is no shared/ directory at all on this branch. The two lineages have diverged since common ancestor a89906ff; nothing to resolve here.
admin/hub_module/frontend/node_modules/ is committed to git	12,381 tracked files, despite node_modules/ being in root .gitignore. Its installed eslint package is broken (MODULE_NOT_FOUND: ../lib/cli) even though the version matches package.json. This is why no Node/ESLint hook is included in .pre-commit-config.yaml — it would fail on every touch regardless of code quality. Recommend: stop committing node_modules/, reinstall clean, then add the ESLint hook back.
deck (38MB Go binary) committed at repo root	Tracked by git, not gitignored. Oddly check-added-large-files (1MB threshold) didn't flag it in a full-repo scan — worth a follow-up look, but unrelated to this PR.
package-lock.json is gitignored (root .gitignore line ~180)	Violates general.md/devops.md npm pinning ("commit package-lock.json, exact versions, npm ci in CI"). Pre-existing, unrelated to hooks.
Existing make lint / make test-security targets swallow all errors via || true	Both are effectively non-blocking today; make pre-commit "passes" regardless of findings. Pre-existing, separate from the new framework this PR adds (which is enforced going forward via git hooks on staged files).
First pre-commit run --all-files	Surfaces tens of thousands of pre-existing violations repo-wide (ruff ~66k output lines, shellcheck ~22k, plus hadolint/actionlint/yaml/json/eof/trim/shebang) — expected for a repo that's never been linted. Not fixable in a hooks-install PR; this PR's own diff is clean under both stages (verified via pre-commit run / pre-commit run --hook-stage pre-push against just the staged files, and the commit/push above both ran clean through the real hooks).

Test plan

• make install-hooks — framework + both hooks registered
• make verify-hooks — both hooks report installed, executable, non-empty
• pre-commit run (commit-stage, staged files) — all pass/skip clean
• pre-commit run --hook-stage pre-push — all pass/skip clean
• Actual git commit and git push of this branch ran through the real hooks and passed
• .worktrees/ already in .gitignore (no change needed)