feat: tool ergonomics (base hooks, tool-ci, mise, tool rulesets)

[taraxvoid]

Closes #155.

Makes voidflow the default kit for any @taraxvoid bun repo, not only Astro sites.

Changes

• lefthook/base.yml (breaking): the hook set moves from lefthook/site.yml to lefthook/base.yml. Before the test:unit and test:push steps it runs unset $(git rev-parse --local-env-vars), so tests that spawn git in a temp repo no longer act on the hooked repo. Tests run the real hook snippets against a stub to check this.
• lefthook/site.yml stub: Renovate bumps only ref:, and lefthook skips a missing remote config without any warning. A plain rename would therefore turn every consumer's hooks off silently. site.yml is now a stub whose pre-commit and pre-push fail with the one-line fix.
• mise: a mise.toml for contributor tools, plus a prepare script that tolerates a missing lefthook binary. The README setup becomes mise install && bun install, and the consumer docs get a starter mise.toml. The package description and keywords now cover tools.
• tool-ci.yml: a reusable validation workflow for bun tools.
  • Steps: gitleaks, the shared install script, mise-action when the repo has a mise.toml, then lint/check/build/test/check:licenses for whichever scripts package.json defines. actionlint and zizmor run when workflows change.
  • The job reports validate / Validate.
  • Parity tests keep the steps it shares identical to site-ci.yml and actions/bun-install.
• Rulesets: a tool() helper (main only, no Netlify, CODEOWNERS, linear history, requires validate / Validate). SITE_CHECK is renamed VALIDATE_CHECK.

Migration

Consumers change configs: [lefthook/site.yml] to lefthook/base.yml when they bump ref. Until they do, commits and pushes fail with that instruction.

Notes

• On free personal plan the rulesets API returns 403 for private repos, which aborts the whole apply-rulesets run.
• bun scripts/apply-rulesets.ts --check reports the fleet in sync. An earlier run listed 5 differences, but none was drift. They were retired next (staging)/live (prod) rulesets on queeromaha, soundry and synthomaha, waiting for --prune. Those rulesets have now been pruned, and the stale next/live branches on soundry and synthomaha (0 commits ahead of main, no open PRs) have been deleted. That cleanup was done out of band; this branch does not change it.

Verification

• bun test: 148 pass, 0 fail.
• just validate: actionlint, check-jsonschema, shellcheck, gitleaks and zizmor all clean.

🤖 Generated with Claude Code

[taraxvoid]

Unblocked this PR: merged main and next in, fixed the 2 failing unit tests, and green CI is back.

• Merge damage from an earlier merge (a7a349a): main's pre-push improvements had landed in the lefthook/site.yml stub. That's why the stub's pre-push ran the old checks instead of failing with the rename hint, and why the pre-push tombstone test failed. The stub reuses *renamed again, and main's better "new commits" detection (deletes, commits already on the remote) moved into lefthook/base.yml. The env-cleanup test now pushes a real commit so that detection can resolve it.
• package.json description: the same merge had reverted it. It's back to "Shared workflows, hooks and tooling for @taraxvoid repos".
• Merge from next: fix(site-ci): replace deprecated actionlint with jactionlint #174 replaced actionlint with jactionlint in site-ci.yml. tool-ci.yml's "Lint CI workflows" step copies it (the parity test requires that), and mise.toml, the README starter mise.toml and the tool-ci docs pin jactionlint = "2.1.0".
• Merge from main: rulesets/index.ts keeps main's "private repos are listed and skipped on 403" comment plus the trailguide note. The tests keep both tool() and isPlanGated.

Locally: bun test passes 151 of 151, just validate passes, and jactionlint is clean.

🤖 Generated with Claude Code