fix(git): isolate hooks per worktree

[bokelley]

What changed

• configure core.hooksPath at worktree scope instead of repository scope
• point directly at the tracked .husky hooks so dependency-install failures cannot disable them
• run the same guarded setup from Conductor workspace setup and npm prepare
• preserve Husky init, PATH, and HUSKY=0 behavior in the tracked hooks

Why

Git stores ordinary repository configuration in the common Git directory shared by every linked worktree. An absolute core.hooksPath from a stale main checkout therefore caused pushes from every Conductor workspace to execute that checkout's outdated hooks. Those hooks ran obsolete whole-repository documentation checks and destructive snapshot rebuilds.

Using Git's worktree configuration extension gives each checkout its own relative hook path, preventing one checkout from redirecting another checkout's hooks.

Impact

New Conductor workspaces and dependency installs configure their own hook path. Existing checkouts can migrate once with npm run prepare after pulling this change.

Validation

• three independent expert reviews: code quality, Git/worktree failure modes, and security/operational safety
• stale shared-path overwrite reproduction with linked worktrees
• nested source-archive guard
• HUSKY=0 pre-commit and pre-push bypasses
• shell syntax and git diff --check
• full pre-commit suite: 437 server test files, 6,171 tests, and TypeScript checks
• current and released-3.0 storyboard compatibility matrices across all seven tenants

[aao-secretariat]

Ladon verdict: Approve

Approve — operational-only git-hook setup change, no blocking findings.

This PR migrates git-hook setup from Husky's shared-scope core.hooksPath to a per-worktree relative path via a new guarded scripts/configure-git-hooks.sh, wired into Conductor setup and npm prepare. Changed files (.conductor/settings.toml, .husky/pre-commit, .husky/pre-push, package.json, scripts/configure-git-hooks.sh) are all tooling/operational — no protocol surface (schemas, task defs, docs/reference/**, release scripts, dist) is touched, so no changeset is required. The package.json edit does not hand-edit version. Worktree-config mechanics are sound: extensions.worktreeConfig shared, core.hooksPath per-worktree, relative .husky resolving against each worktree root; the enable-worktreeConfig caveat does not apply here.

Decision path: no critical/high findings (row 1 n/a); gated_paths false (row 2 n/a); high_risk false (rows 3/5 n/a); no medium findings at all (rows 4/8 n/a); no prior decision (row 6 n/a); no no-auto-approve team match (row 7 n/a). Falls through to row 9 → approve. Note: review_decision is REVIEW_REQUIRED, but that only forces escalate when gated_paths is true, which it is not here.