Add prek-powered git pre-commit hooks (#3001)

* Add prek-powered git pre-commit hooks

Adopts the fleet hook pattern established in basecamp/bc3#12423: prek
(j178/prek, a Rust pre-commit reimplementation) installs as a sha256-verified
prebuilt binary via mise's aqua backend, and this change introduces working
commit hooks where none ran before.

- .githooks/pre-commit is checked in with the bin/bcenv shebang; bcenv
  transparently re-execs through a login shell so GUI git clients resolve
  mise-managed tools
- bin/setup points core.hooksPath at .githooks; anyone who runs bin/setup
  (including outside contributors) gets local blocking hooks from then on
- prek.toml declares rubocop (staged files only, --force-exclusion honors
  .rubocop.yml) plus the merge-conflict/case-conflict/large-file/private-key
  safety builtins

* bcenv: resync from bc3 — seed mise's standard install locations

Byte-identical resync of the canonical bc3 copy (basecamp/bc3#12426): the
non-interactive login shell never reads interactive rc files, so a mise
activated only there (its documented setup) was invisible to the old
/usr/local/bin:/usr/bin:/bin seed. ~/.local/bin (mise.run installer) and
/opt/homebrew/bin (Apple Silicon brew) join the seed so the shims probe
finds mise regardless. Verified upstream by bc3's bcenv behavioral matrix
(22/22, negative control confirmed).

Author: jeremy

.githooks/pre-commit

@@ -0,0 +1,2 @@
+#!/usr/bin/env -S bin/bcenv bash
+exec prek run

.mise.toml

@@ -5,6 +5,7 @@ idiomatic_version_file_enable_tools = ["ruby"]
 
 [tools]
 gum = "0.17.0"
+prek = "0.4.11"
 
 [env]
 PROMETHEUS_EXPORTER_URL = "http://127.0.0.1:9306/metrics"

bin/bcenv

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -e
+
+# macOS doesn't launch GUI apps through a login shell, but
+# login shell profiles are how we conventionally set user-
+# specific environment variables like PATH. This can cause
+# trouble with apps like Tower that need to run git hooks.
+#
+# The `bcenv` command transparently re-execs the command
+# specified in the argument list through a login shell.
+
+if [ $# -eq 0 ]; then
+  echo "usage: bcenv command [args...]" 2>&1
+  exit 1
+fi
+
+if command -v dscl >/dev/null; then
+  read -r SHELL < <( dscl . -read "/Users/$(whoami)" UserShell )
+elif command -v getent >/dev/null; then
+  SHELL="$( getent passwd "$(whoami)" | cut -d: -f7 )"
+else
+  SHELL="/bin/sh"
+fi
+
+SHELL="${SHELL#*: }"
+
+# mise-managed tools (node, ruby, bundler) must resolve in this context even when
+# the user's profile only activates mise for interactive shells — git hooks run
+# through bcenv as non-interactive login shells. Shims are mise's recommended
+# non-interactive activation; no-op when mise isn't on the login PATH. The snippet
+# is generated for the detected login shell; unknown shells get no preamble.
+#
+# The argument vector is forwarded POSITIONALLY, never serialized into shell
+# source text: no quoting dialect survives every login shell (bash %q output
+# is not fish syntax — newline and tab arguments made fish exit 127). POSIX
+# shells receive the vector after a $0 sentinel; fish exposes it as $argv.
+#
+# Tested support surface: bash, zsh, fish (test/bcenv-matrix-test). C shells
+# were never supported — csh/tcsh reject `-l` combined with `-c` outright,
+# before any payload syntax is reached.
+# Seed the base PATH a login shell normally inherits from PAM, plus mise's
+# standard install locations: ~/.local/bin (the mise.run installer) and
+# /opt/homebrew/bin (Apple Silicon brew; Intel brew is /usr/local/bin, package
+# managers are /usr/bin). The login shell here is non-interactive (-l -c), so
+# a profile that only activates mise in interactive rc files (.bashrc/.zshrc —
+# mise's documented setup) never adds it to PATH; the shims probe below must
+# find mise from the seed alone. With PATH unset, /etc/profile.d scripts run
+# without /usr/bin, and a not-found command can send a command-not-found
+# handler recursing into a fork bomb. The login profile still rebuilds its
+# PATH on top.
+base_path="$HOME/.local/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
+
+# shellcheck disable=SC2016  # the preamble expands in the login shell, not here
+case "${SHELL##*/}" in
+  bash | zsh | sh )
+    mise_shims='command -v mise >/dev/null && eval "$(mise activate bash --shims)"; '
+    exec env PATH="$base_path" "$SHELL" -l -c "${mise_shims}exec \"\$@\"" bcenv "$@" ;;
+  fish )
+    mise_shims='command -v mise >/dev/null; and mise activate fish --shims | source; '
+    exec env PATH="$base_path" "$SHELL" -l -c "${mise_shims}exec \$argv" "$@" ;;
+  * )
+    exec env PATH="$base_path" "$SHELL" -l -c 'exec "$@"' bcenv "$@" ;;
+esac

bin/setup

@@ -146,6 +146,8 @@ fi
 step "Installing Ruby and tools" mise install --yes
 eval "$(mise hook-env -s bash)"
 
+step "Installing Git pre-commit hooks" git config core.hooksPath .githooks
+
 # Install gh if needed
 if ! command -v gh &>/dev/null; then
   echo

prek.toml

@@ -0,0 +1,14 @@
+[[repos]]
+repo = "local"
+hooks = [
+  { id = "rubocop", name = "rubocop", language = "system", entry = "bin/rubocop --force-exclusion", types = ["ruby"] },
+]
+
+[[repos]]
+repo = "builtin"
+hooks = [
+  { id = "check-merge-conflict" },
+  { id = "check-case-conflict" },
+  { id = "check-added-large-files" },
+  { id = "detect-private-key" },
+]