Add pre-push guard for main branch

[Copilot]

This adds a repository-managed pre-push hook to stop direct pushes to main when the workspace is not in a buildable state. It closes the gap between local pushes and the checks already enforced in CI.

• Main-branch push guard

  • adds .githooks/pre-push
  • only runs for pushes that update refs/heads/main
  • blocks the push unless these commands succeed:
    • cargo metadata --format-version 1 --locked
    • cargo build --verbose
    • cargo test --verbose

• Hook installation

  • adds .githooks/install to configure core.hooksPath for the clone
  • keeps hook management in-repo instead of relying on manual copy/symlink steps

• Developer setup

  • enables the repo hook automatically in the devcontainer post-create setup
  • documents the hook in CONTRIBUTING.md for non-devcontainer contributors

Example:

./.githooks/install
git push origin main

With the hook enabled, the push is rejected before Git updates main if the lockfile, build, or test checks fail.