Add prek-powered git pre-commit hooks

Adopts the fleet hook pattern established in basecamp/bc3#12423: prek
(j178/prek, a Rust pre-commit reimplementation) installs as a sha256-verified
prebuilt binary via mise's aqua backend, and this change introduces working
commit hooks where none ran before.

- .githooks/pre-commit is checked in with the bin/bcenv shebang; bcenv
  transparently re-execs through a login shell so GUI git clients resolve
  mise-managed tools
- bin/setup points core.hooksPath at .githooks; anyone who runs bin/setup
  (including outside contributors) gets local blocking hooks from then on
- prek.toml declares rubocop (staged files only, --force-exclusion honors
  .rubocop.yml) plus the merge-conflict/case-conflict/large-file/private-key
  safety builtins

Author: jeremy

.githooks/pre-commit

@@ -0,0 +1,2 @@
+#!/usr/bin/env -S bin/bcenv bash
+exec prek run

.mise.toml

@@ -5,6 +5,7 @@ idiomatic_version_file_enable_tools = ["ruby"]
 
 [tools]
 gum = "0.17.0"
+prek = "0.4.11"
 
 [env]
 PROMETHEUS_EXPORTER_URL = "http://127.0.0.1:9306/metrics"

bin/bcenv

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -e
+
+# macOS doesn't launch GUI apps through a login shell, but
+# login shell profiles are how we conventionally set user-
+# specific environment variables like PATH. This can cause
+# trouble with apps like Tower that need to run git hooks.
+#
+# The `bcenv` command transparently re-execs the command
+# specified in the argument list through a login shell.
+
+if [ $# -eq 0 ]; then
+  echo "usage: bcenv command [args...]" 2>&1
+  exit 1
+fi
+
+if command -v dscl >/dev/null; then
+  read -r SHELL < <( dscl . -read "/Users/$(whoami)" UserShell )
+elif command -v getent >/dev/null; then
+  SHELL="$( getent passwd "$(whoami)" | cut -d: -f7 )"
+else
+  SHELL="/bin/sh"
+fi
+
+SHELL="${SHELL#*: }"
+
+# mise-managed tools (node, ruby, bundler) must resolve in this context even when
+# the user's profile only activates mise for interactive shells — git hooks run
+# through bcenv as non-interactive login shells. Shims are mise's recommended
+# non-interactive activation; no-op when mise isn't on the login PATH. The snippet
+# is generated for the detected login shell; unknown shells get no preamble.
+#
+# The argument vector is forwarded POSITIONALLY, never serialized into shell
+# source text: no quoting dialect survives every login shell (bash %q output
+# is not fish syntax — newline and tab arguments made fish exit 127). POSIX
+# shells receive the vector after a $0 sentinel; fish exposes it as $argv.
+#
+# Tested support surface: bash, zsh, fish (test/bcenv-matrix-test). C shells
+# were never supported — csh/tcsh reject `-l` combined with `-c` outright,
+# before any payload syntax is reached.
+# Seed the base PATH a login shell normally inherits from PAM. With PATH unset,
+# /etc/profile.d scripts run without /usr/bin, and a not-found command can send a
+# command-not-found handler recursing into a fork bomb. The login profile still
+# rebuilds the full PATH on top.
+base_path="/usr/local/bin:/usr/bin:/bin"
+
+# shellcheck disable=SC2016  # the preamble expands in the login shell, not here
+case "${SHELL##*/}" in
+  bash | zsh | sh )
+    mise_shims='command -v mise >/dev/null && eval "$(mise activate bash --shims)"; '
+    exec env PATH="$base_path" "$SHELL" -l -c "${mise_shims}exec \"\$@\"" bcenv "$@" ;;
+  fish )
+    mise_shims='command -v mise >/dev/null; and mise activate fish --shims | source; '
+    exec env PATH="$base_path" "$SHELL" -l -c "${mise_shims}exec \$argv" "$@" ;;
+  * )
+    exec env PATH="$base_path" "$SHELL" -l -c 'exec "$@"' bcenv "$@" ;;
+esac

bin/setup

@@ -149,6 +149,8 @@ fi
 step "Installing Ruby and tools" mise install --yes
 eval "$(mise hook-env -s bash)"
 
+step "Installing Git pre-commit hooks" git config core.hooksPath .githooks
+
 # Install gh if needed
 if ! command -v gh &>/dev/null; then
   echo

prek.toml

@@ -0,0 +1,14 @@
+[[repos]]
+repo = "local"
+hooks = [
+  { id = "rubocop", name = "rubocop", language = "system", entry = "bin/rubocop --force-exclusion", types = ["ruby"] },
+]
+
+[[repos]]
+repo = "builtin"
+hooks = [
+  { id = "check-merge-conflict" },
+  { id = "check-case-conflict" },
+  { id = "check-added-large-files" },
+  { id = "detect-private-key" },
+]