feat(ci): make the root pre-push hook fast by default

[agjs]

Summary

The root pre-push hook now runs a fast gate by default:

• the gitleaks secret scan
• each changed app's bun run check (typecheck, lint, lint:meta, format, knip, as the app defines it)
• the UI tests for the files the push changes (vitest --changed since the branch's last push, or main for a new branch)
• shared packages
• the static Compose checks

Full test suites, builds, bundle budgets, semgrep, osv-scanner and the smoke and Playwright runs stay in the pull request's required checks, which block the merge. FULL_PREPUSH=1 git push runs the whole gate locally, unchanged.

Tinkercaster, the first product on the template, made the same change after paying the full gate on every push. The full gate's Playwright run also failed whenever another stack held :7330/:7331, so pushes were routinely made with --no-verify. Ledger entry 119 is updated.

Docs: AGENTS.md, the public agents.md, lint-as-contract, apps/ui/budgets.md and the changelog now describe the fast and full gates.

Test plan

• Fast hook against the diff since before fix: template bugs found in the first product's code #496 (API, UI, site, packages, scripts, Compose): every fast step ran and passed in 88s
• This branch was pushed through the real hook with no --no-verify: 19s
• tools/agent/pre-push-shell.test.ts: the fast path exits before the full gate and --secrets-only stops after gitleaks
• shellcheck, agent:quality, apps/docs build:ci