feat(gates): enforce metadata.version bumps on changed skills at pre-push

check-skill-version-bump fails a push when a skill directory changed
against its merge-base with main (tests/ excluded) without a strictly
higher metadata.version than main. New, renamed and deleted skills are
exempt; every plugin is covered. Recorded as a dated section in
ADR-0022 and documented in gates.md.

Patch-bumps the 17 skills that changed on this branch without a bump,
so the branch passes its own gate. Simplification audit finding 33.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.pre-commit-config.yaml

@@ -192,6 +192,19 @@ repos:
         pass_filenames: false
         always_run: true
 
+      - id: check-skill-version-bump
+        name: Check changed skills bump metadata.version
+        description: On every push, fail if a skill directory changed (tests/ excluded) since the merge-base with main without its SKILL.md metadata.version rising (ADR-0022)
+        entry: bash scripts/check-skill-version-bump.sh
+        language: system
+        stages: [pre-push]
+        pass_filenames: false
+        always_run: true
+        # Baseline is the merge-base with origin/main (falling back to main),
+        # not the remote branch tip: readers install from main. Fails closed
+        # when no main ref resolves. Merges through Gitea's merge button run no
+        # local hook, so they bypass this, just as they bypass check-release-needed.
+
       - id: validate-marketplace
         name: Validate marketplace manifest
         description: Run claude plugin validate --strict on the root marketplace manifest