feat(sync-check): canonical/mirror drift detection + pre-commit hook

scripts/sync-check.sh diffs claude-templates/.ai/{protocols.org,
workflows,scripts} against the .ai/ mirror. Exits 0 when clean, 1 with
a diff report on drift, 2 outside a rulesets-shaped repo or git
checkout. --fix mode rsyncs canonical -> mirror and re-checks, then
prompts to re-stage.

githooks/pre-commit wraps the script. Commits abort on drift so the
issue surfaces at publish time, not at the next session's startup
rsync.

Two new Makefile targets:
- make sync-check [FIX=1] runs the script (FIX=1 passes --fix
  through).
- make install-githooks sets core.hooksPath=githooks (idempotent).

scripts/tests/sync-check.bats holds 8 tests covering clean,
drift-per-path, --fix, extra-file removal, missing canonical, and
outside-git. All eight pass.

This catches the exact drift I had to fix manually during this
morning's audit pass. The mirror's open-tasks.org PROPERTIES drawer
sat below a sub-heading because the mirror commit was older than
canonical.

1 files changed, 15 insertions, 0 deletions

diff --git a/githooks/pre-commit b/githooks/pre-commit
new file mode 100755
index 0000000..ece0c8a
--- /dev/null
+++ b/githooks/pre-commit
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+#
+# pre-commit hook — block commits when the canonical/mirror pair drifts.
+#
+# Enable by running: git config core.hooksPath githooks
+# (handled by make install-hooks; idempotent on re-run.)
+
+set -euo pipefail
+
+repo_root="$(git rev-parse --show-toplevel)"
+"$repo_root/scripts/sync-check.sh" || {
+    echo "" >&2
+    echo "pre-commit: canonical/mirror drift detected. Commit blocked." >&2
+    exit 1
+}