Run CI-equivalent checks before push

[happykhan]

Summary

• make local and GitHub CI use the same verify:ci package scripts
• install a tracked pre-push hook during npm ci/npm install
• fail early when the local Node major does not match .nvmrc
• run architecture checks with only clean-runner system commands to catch undeclared tools such as rg
• keep dependency changes eligible for post-merge CI and update contributor instructions

Why

The failed master run was locally reproducible via the existing security audit, while the first renderer catch-up run failed because a quality script used rg, which happened to exist locally but not on the Ubuntu runner. This makes those checks automatic before push and makes CI invoke those exact same commands.

The nanoid lockfile update overlaps #45 so this branch can pass its own pre-push security gate against the current master; that diff will disappear automatically if #45 lands first.

Verification

• clean npm ci with Node 24.18.1
• confirmed the hook rejects Node 20.11.1 before running the suite
• confirmed the portability guard passes with PATH restricted to /usr/bin:/bin
• npm run verify
  • security audit: 0 unaccepted advisories
  • unit tests: 176 passed
  • production build: passed
  • production browser tests: 25 passed
  • development-runtime browser test: passed
• real git push completed through the new pre-push hook

[cloudflare-workers-and-pages]

Deploying brigx with    Cloudflare Pages

Latest commit:	203aa9f
Status:	✅  Deploy successful!
Preview URL:	https://f55e6d3a.brigx.pages.dev
Branch Preview URL:	https://codex-local-pre-ci-gate.brigx.pages.dev

View logs