ci: make the lefthook pre-push hook actually install (#4642)

## Summary

`lefthook.yml` has been in the repo since #4147, but nothing installs
lefthook and nothing runs `lefthook install`, so the pre-push hook it
describes has never fired for anyone. #3977 had removed the `lefthook`
devDependency a week before #4147 landed, and #4147 only added the
config file.

This supplies the missing half:

```diff
+    "prepare": "lefthook install",
+    "lefthook": "^2.1.10",
       "onlyBuiltDependencies": [
+      "lefthook",
```

With those in place, `pnpm install` wires the hook up on clone, and the
format and lint checks actually run before a push instead of first
failing in CI.

Also here: the pre-push jobs run in parallel rather than in sequence,
and `CONTRIBUTING.md` documents the hook, including how to skip it and
the fact that GitButler only runs hooks when "Run hooks" is enabled in
its settings.

`lefthook@2.1.10` is the current release.

Author: nicktrn

.oxfmtrc.json

@@ -21,6 +21,7 @@
     "**/storybook-static/",
     "**/.changeset/",
     "**/dist/",
+    "**/.worktrees/",
     "internal-packages/tsql/src/grammar/",
     "internal-packages/llm-model-catalog/src/defaultPrices.ts",
     "internal-packages/llm-model-catalog/src/modelCatalog.ts",

.oxlintrc.json

@@ -12,6 +12,7 @@
   "ignorePatterns": [
     "**/dist/**",
     "**/build/**",
+    "**/.worktrees/**",
     "**/*.d.ts",
     "**/seed.js",
     "**/seedCloud.ts",

CONTRIBUTING.md

@@ -214,6 +214,19 @@ pnpm exec trigger dev --log-level debug
 5. Commit the generated migration files as well as the changes to `schema.prisma`.
 6. If you're using VSCode you may need to restart the TypeScript server in the webapp to get updated type inference. Open a TypeScript file, then open the Command Palette (View > Command Palette) and run `TypeScript: Restart TS server`.
 
+## Git hooks (lefthook)
+
+We use [lefthook](https://lefthook.dev) for local git hooks, configured in `lefthook.yml` (the source of truth for what runs and when). Today that's a pre-push hook mirroring the CI `code-quality` checks; the set may grow, so check `lefthook.yml` rather than this guide.
+
+Hooks install automatically on `pnpm install`. A failing hook prints exactly what to run to fix it.
+
+**Opting out**
+
+- GitButler skips hooks on `but push` unless you enable **Run hooks** in the project settings (off by default).
+- Plain git: `LEFTHOOK=0 git push` / `--no-verify` to skip once; `pnpm exec lefthook uninstall` to remove.
+
+This never affects correctness — CI enforces the same checks on every PR; the hooks just give you faster feedback.
+
 ## Making a pull request
 
 **If you get errors, be sure to fix them before committing.**

lefthook.yml

@@ -10,8 +10,29 @@ pre-commit:
 # implementation and only runs hooks when "Run hooks" is enabled in its
 # settings - with that off, this protects plain `git push` only.
 pre-push:
+  parallel: true
   jobs:
     - name: format
-      run: pnpm exec oxfmt --check .
+      run: |
+        pnpm exec oxfmt --check . || {
+          echo ""
+          echo "✖ Formatting issues found. Fix them with:"
+          echo ""
+          echo "    pnpm run format"
+          echo ""
+          echo "  then stage the changes and re-push."
+          echo ""
+          exit 1
+        }
     - name: lint
-      run: pnpm exec oxlint .
+      run: |
+        pnpm exec oxlint . || {
+          echo ""
+          echo "✖ Lint errors found. Auto-fix what's fixable with:"
+          echo ""
+          echo "    pnpm run lint:fix"
+          echo ""
+          echo "  then review, stage, and re-push (some rules need a manual fix)."
+          echo ""
+          exit 1
+        }

package.json

@@ -63,6 +63,7 @@
     "@vitest/coverage-v8": "4.1.7",
     "autoprefixer": "^10.4.12",
     "knip": "6.25.0",
+    "lefthook": "^2.1.10",
     "oxfmt": "^0.54.0",
     "oxlint": "^1.69.0",
     "pkg-pr-new": "0.0.75",
@@ -157,6 +158,7 @@
       "better-sqlite3",
       "cpu-features",
       "esbuild",
+      "lefthook",
       "prisma",
       "protobufjs",
       "sharp",