fix: run the pre-commit hooks in CI and clear bandit and shellcheck (#59)

[tschm]

Fixes #59.

Acceptance criterion (verbatim): "a CI job runs the full hook set on every PR and push to main, and it passes on main."

What changed

• .github/workflows/hooks.yml (new): runs uvx prek@0.5.4 run --all-files --show-diff-on-failure on every pull request and every push to main. Actions are SHA-pinned and uv is pinned to 0.11.28, matching ci.yml.
  • The issue suggested adding this as a job in ci.yml. I made it a separate workflow because ci.yml has paths-ignore for prose, so a docs-only PR would skip markdownlint. That would contradict the criterion's "every PR".
• bandit: B404/B603/B607 in localgit.py and origin.py are acknowledged with # nosec on the exact lines, plus a comment explaining why. The argv is fixed, there's no shell, and git comes from PATH on purpose. I didn't add a global bandit skip, so any new subprocess call is still flagged.
• shellcheck SC2329 in image/entrypoint.sh is silenced with a directive on stop(), which is only called through trap.
• collector/README.md: added the prek command to the from-the-root list of CI checks.

Gates (run locally on this branch)

• uvx prek@0.5.4 run --all-files: all 14 hooks pass (bandit and shellcheck were failing before)
• ruff check and ruff format --check: pass
• mypy (strict, scope from [tool.mypy]): no issues in 11 files
• pytest --cov=jq_collector: 456 passed, 100% of lines and branches
• bash -n image/entrypoint.sh: parses

Not addressed

• The stop() comment says the code signals the process group, but it signals each pid. That's Make entrypoint.sh stop() match its comment: group signal vs per-pid kill #62, which needs a decision, so this PR leaves it alone.

Closes #59

🤖 Generated with Claude Code