fix(lint): hard-fail on main when a release tag is needed

.pre-commit-hooks.yaml now exposes hooks to external consumers pinning
rev: <tag>, but nothing enforced that a tag actually gets cut when the
files it references change — relying on memory is exactly what this
repo's governance rules say to avoid for a repeatable, deterministic
check.

scripts/check-release-needed.sh hard-fails at pre-push, but only when
PRE_COMMIT_REMOTE_BRANCH (set by pre-commit's hook-impl) is
refs/heads/main: it diffs .pre-commit-hooks.yaml's referenced paths
against the last tag reachable from HEAD, and fails if either no tag
exists yet or something changed since. It's a silent no-op on every
other branch — hard-failing on feature-branch pushes mid-review would
force a premature tag on a commit that might not survive a
squash-merge, the exact risk the repo: local (vs. pinned self-
reference) decision in ADR-0014 already avoids for this repo's own
dev-time gate.

Verified against the real git pre-push hook path (not just the script
in isolation): simulated stdin matching git's pre-push protocol through
.git/hooks/pre-push, confirmed it correctly fires and fails when
targeting main with no tag, and is silent otherwise.

ADR: 0014
Refs: #87

.pre-commit-config.yaml

@@ -70,6 +70,15 @@ repos:
         pass_filenames: false
         always_run: true
 
+      - id: check-release-needed
+        name: Check a release tag covers .pre-commit-hooks.yaml's paths
+        description: On push to main only, fail if files exposed via .pre-commit-hooks.yaml changed since the last tag
+        entry: bash scripts/check-release-needed.sh
+        language: system
+        stages: [pre-push]
+        pass_filenames: false
+        always_run: true
+
       - id: validate-plugins
         name: Validate plugins
         description: Run claude plugin validate --strict on every plugin directory