Add lefthook git hooks with a vendor-manifest guard

pre-commit: ESLint --fix on staged files (vendored source excluded),
incremental typecheck, and the vendor-manifest guard — any staged
change under vendor/*/src must be accompanied by a vendor/README.md
update in the same commit, mechanizing the local-modification log
discipline. pre-push: tests + hygiene (knip/publint/constraints).
Hooks call the same package.json scripts CI runs (single source of
truth); installed automatically via postinstall.

package.json

@@ -21,7 +21,8 @@
     "knip": "knip",
     "publint": "tsx scripts/publint-all.ts",
     "hygiene": "yarn knip && yarn publint && yarn constraints",
-    "demo": "node --expose-internals --import tsx examples/echo-agent/start.ts"
+    "demo": "node --expose-internals --import tsx examples/echo-agent/start.ts",
+    "postinstall": "lefthook install"
   },
   "devDependencies": {
     "@stylistic/eslint-plugin": "^5.10.0",
@@ -31,6 +32,7 @@
     "dumble": "^0.2.3",
     "eslint": "^10.4.1",
     "knip": "^6.16.1",
+    "lefthook": "^2.1.9",
     "publint": "^0.3.21",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3",