chore: add a pre-commit config adapted from jebel-quant/rhiza

[tschm]

Adds .pre-commit-config.yaml, adapted from jebel-quant/rhiza for a repo that isn't rhiza-managed and keeps its Python project in collector/. The header comment records each change:

• Dropped: rhiza-hooks (they validate .rhiza/), the template-bundles and renovate schema checks (those files don't exist here), and interrogate (without a [tool.interrogate] table it would use its own defaults, a standard nobody here chose).
• Rescoped: bandit to collector/jq_collector/ (rhiza reads a .bandit file this repo doesn't have), uv-lock to --project collector, and validate-pyproject to collector/pyproject.toml.
• Pinned: ruff to v0.16.9, the version in collector/uv.lock, so the hook and CI's Lint step can't disagree.

It also includes the one change ruff-format made when first run: two blank lines removed in scripts/check-dashboard.py. CI's Format step only covers jq_collector tests, which is why this drift was never caught.

The hooks don't all pass yet (uvx prek run --all-files): 11 pass, 2 fail.

• bandit: B314/B405 on github.py (tracked in Parse downloaded coverage.xml with defusedxml (bandit B314) #50), plus B404/B603/B607 on the fixed-argument git subprocess calls in localgit.py and origin.py.
• shellcheck: SC2329 at image/entrypoint.sh:44, a false positive, since stop() is called through trap stop TERM INT.

Nothing runs these hooks in CI yet, so merging this changes no check. Wiring them in is a follow-up once these failures are cleared.

🤖 Generated with Claude Code