feat: add cross-platform Node Git hook

[anusbutt]

Outcome

Replace the package-owned shell pre-commit wrapper with a minimal, rule-free Node launcher that invokes the same repository-local scripts/validate.mjs --staged validator used by graphkeeper check.

PR #23 was squash-merged while this PR was stacked. This branch has been rebased onto the resulting main, so the review now contains one Phase 3 commit and 12 changed files only.

This PR does not change query, update, prerequisites, validate.sh, graph schema/data, or claim complete native Windows support.

Evidence

The initial CI run exposed two independent issues:

1. The extensionless installed hook used static ESM imports, which Node 18 parsed as CommonJS outside a module package scope.
2. The Windows no-sh/no-jq acceptance setup assumed jq lived in the local helper directory, while CI installed it through Chocolatey.

The hook now uses dynamic built-in imports compatible with Node 18 in both CommonJS and ESM scopes. The Windows acceptance test resolves and removes the actual directories providing sh and jq while preserving Git and Node.

Verification after the fixes:

• Focused hook/template/migration suite: 20 passed.
• Real pre-commit acceptance file: 7 passed, including explicit CommonJS scope, valid and invalid native Windows commits without sh/jq, missing-validator failure, and custom core.hooksPath.
• Exact local functional CI command: 298 passed, 3 expected Windows skips, plus 2 package tests.
• Exact local performance CI command: 5 passed.
• GitHub Actions:
  • quality-ubuntu
  • quality-macos
  • quality-windows-git-bash
  • performance-ubuntu
  • performance-windows-git-bash
• npm run validator:check, npm run typecheck, and npm run package:smoke passed.
• node --check templates/pre-commit, LF-only verification, and git diff --check passed.

Checklist

• Tests cover valid, invalid, migration, collision, concurrency, security, and performance paths.
• CI and contributor syntax checks reflect the Node hook.
• Schema compatibility is unchanged.
• Constitution principles and append-only/evidence guarantees remain satisfied.
• npm run build passes.
• npm run typecheck passes.
• Full relevant functional, security, package, and performance suites pass.
• npm run package:smoke passes and the tarball contains intended assets only.
• sh -n scripts/validate.sh and node --check templates/pre-commit pass.
• No secrets, credentials, telemetry, generated archives, SDD artifacts, or unrelated edits are included.

Compatibility and recovery

Only the exact package-owned legacy installed hook or exact package-owned legacy fallback is migrated. Modified marker-bearing hooks, third-party hooks, custom hook paths, and concurrent edits remain protected. The launcher forwards validator output and status and fails closed when the repository Node validator is missing.

Linux, macOS, Windows Git Bash, and native-Windows hook journeys are verified for this phase. Query still requires jq, and init/update still reject native PowerShell, so the overall native Windows support claim remains deferred to later phases.