Add lefthook git hooks with a vendor-manifest guard

pre-commit: ESLint --fix on staged files (vendored source excluded),
incremental typecheck, and the vendor-manifest guard — any staged
change under vendor/*/src must be accompanied by a vendor/README.md
update in the same commit, mechanizing the local-modification log
discipline. pre-push: tests + hygiene (knip/publint/constraints).
Hooks call the same package.json scripts CI runs (single source of
truth); installed automatically via postinstall.

scripts/check-vendor-manifest.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Vendoring discipline, mechanized: any staged change under vendor/*/src or a
+# vendored bin.js must come with a vendor/README.md change in the same commit
+# (the manifest's local-modification log is the contract — see vendor/README.md).
+set -euo pipefail
+
+staged=$(git diff --cached --name-only)
+
+vendor_src_changed=$(echo "$staged" | grep -E '^vendor/[^/]+/(src/|bin\.js)' || true)
+manifest_changed=$(echo "$staged" | grep -x 'vendor/README.md' || true)
+
+if [[ -n "$vendor_src_changed" && -z "$manifest_changed" ]]; then
+  echo 'vendor manifest guard: vendored SOURCE changed without updating vendor/README.md:'
+  echo "$vendor_src_changed" | sed 's/^/  /'
+  echo 'Log the modification in vendor/README.md ("Local modifications") and stage it.'
+  exit 1
+fi