Add Bun lockfile pre-commit check

[knhn1004]

Summary

Adds a project-scoped pre-commit hook that checks Bun lockfile sync for the repo's Bun package areas before a commit is accepted.

What changed

• Added a committed .githooks/pre-commit wrapper.
• Added scripts/check-bun-locks.sh to run bun install --frozen-lockfile only for staged package manifest changes in cli or control-plane/dashboard-ui.
• Added scripts/install-git-hooks.sh to configure core.hooksPath=.githooks for a clone.
• Added shell regression coverage for unrelated commits, missing Bun on unrelated commits, clean package manifest checks, and dirty lockfile detection.

Test plan

• bash -n scripts/check-bun-locks.sh scripts/install-git-hooks.sh .githooks/pre-commit tests/hooks/check-bun-locks.test.sh
• bash tests/hooks/check-bun-locks.test.sh
• .githooks/pre-commit
• bun test passes (cli)
• cargo test passes (ledger)
• go test -race ./... passes (control-plane)

Notes for reviewers

This is local Git hook plumbing only. Developers need to run scripts/install-git-hooks.sh once per clone to enable the committed hook path.

Checklist

• I read CONTRIBUTING.md
• No secrets, real tokens, or .env content committed
• Public docs updated if user-facing behavior changed