chore(githooks): refresh pre-commit/post-commit/post-merge from the lib (gitleaks backstop, autopush)

.githooks/post-commit

@@ -0,0 +1,15 @@
+#!/bin/sh
+# gitflow post-commit — generated by gitflow_init. Do not hand-edit.
+# Pushes every commit as it lands (BDR-095): a remote only backs up what it
+# holds. Never fails the commit: no origin / offline / refused → warning only.
+# Opt out for one command with GITFLOW_NO_PUSH=1 (throwaway repos, tests).
+[ "${GITFLOW_NO_PUSH:-0}" = 1 ] && exit 0
+# Per-repo opt-out (no push rights on a foreign clone): git config gitflow.autopush false
+[ "$(git config --bool --default true gitflow.autopush)" = false ] && exit 0
+git remote get-url origin >/dev/null 2>&1 || exit 0
+br=$(git symbolic-ref --short -q HEAD 2>/dev/null) || exit 0   # detached HEAD — nothing to track
+if command -v timeout >/dev/null 2>&1; then t="timeout ${GITFLOW_PUSH_TIMEOUT:-30}"; else t=""; fi
+if $t git push -q -u --follow-tags origin "$br" >/dev/null 2>&1; then exit 0; fi
+echo "gitflow post-commit: push of '$br' FAILED — this commit exists only on this disk." >&2
+echo "  Push by hand: git push -u origin $br   (rejected as non-fast-forward? never force-push; ask first)" >&2
+exit 0