feat(sync-check): canonical/mirror drift detection + pre-commit hook

scripts/sync-check.sh diffs claude-templates/.ai/{protocols.org,
workflows,scripts} against the .ai/ mirror. Exits 0 when clean, 1 with
a diff report on drift, 2 outside a rulesets-shaped repo or git
checkout. --fix mode rsyncs canonical -> mirror and re-checks, then
prompts to re-stage.

githooks/pre-commit wraps the script. Commits abort on drift so the
issue surfaces at publish time, not at the next session's startup
rsync.

Two new Makefile targets:
- make sync-check [FIX=1] runs the script (FIX=1 passes --fix
  through).
- make install-githooks sets core.hooksPath=githooks (idempotent).

scripts/tests/sync-check.bats holds 8 tests covering clean,
drift-per-path, --fix, extra-file removal, missing canonical, and
outside-git. All eight pass.

This catches the exact drift I had to fix manually during this
morning's audit pass. The mirror's open-tasks.org PROPERTIES drawer
sat below a sub-heading because the mirror commit was older than
canonical.

1 files changed, 7 insertions, 0 deletions

diff --git a/Makefile b/Makefile
index 2ade6e1..3838597 100644
--- a/Makefile
+++ b/Makefile
@@ -431,6 +431,13 @@ audit: ## Verify project .ai/ dirs against canonical ([APPLY=1] [FORCE=1] [NO_DO
 		$(if $(FORCE),--force) \
 		$(if $(NO_DOCTOR),--no-doctor)
 
+sync-check: ## Verify claude-templates/.ai/ canonical matches .ai/ mirror ([FIX=1])
+	@bash scripts/sync-check.sh $(if $(FIX),--fix)
+
+install-githooks: ## Point this repo's core.hooksPath at githooks/ (idempotent — enables pre-commit sync-check)
+	@git config core.hooksPath githooks
+	@echo "core.hooksPath=githooks (pre-commit will run scripts/sync-check.sh)"
+
 install-ai: ## Bootstrap .ai/ in a fresh project ([PROJECT=<path>] [TRACK=1 | GITIGNORE=1])
 	@bash scripts/install-ai.sh \
 		$(if $(TRACK),--track) \