chore: add git hooks and commit conventions

[RedStar071]

Summary

Add lightweight local commit quality gates for contributors.

• add Husky 9 and install hooks through the prepare lifecycle via .husky/install.mjs, which skips installation in CI and production (Husky how-to)
• run nano-staged from pre-commit so only staged files are formatted with Oxfmt
• run commitlint from commit-msg
• use @commitlint/config-conventional to enforce Conventional Commit messages
• raise engines.node to >=22.18, matching the documented toolchain (nano-staged 1.x needs util.styleText, unavailable on Node 20.11)
• document the hook workflow and how to resolve hook failures in CONTRIBUTING.md

Hooks

• pre-commit → pnpm exec nano-staged
• commit-msg → pnpm exec commitlint --edit "$1"

Dependency note

The dependency declarations use current Husky 9.1.7, nano-staged 1.0.2 and commitlint 21.x. pnpm-lock.yaml has been regenerated with pnpm 10.15.0 (pnpm install --lockfile-only), so pnpm install --frozen-lockfile passes again in CI.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is enabled.}

Confidence Score: 5/5

No blocking failure remains.

The Node.js compatibility, hook installation behavior, staged-file formatting, and commit-message enforcement paths were exercised successfully against the current configuration.

T-Rex Logs

What T-Rex did

• Validated Node compatibility by running the pre-commit formatter across disposable worktrees with Node.js 20.11.1 and 22.18.0; 20.11.1 failed before formatting while 22.18.0 succeeded and re-staged the formatted fixture.
• Compared Node runtimes, showing that Node 20.11.1 exits with an error before tasks run, while Node 22.18.0 exits successfully and updates the staged formatting.
• Validated the prepared hook runs by executing the prepare-installed-hooks-01-before and 02-after captures, which show the invalid and valid message sequences and confirm the hook-workflow script used.
• Executed the hook workflow validation script for invalid and valid messages; the invalid Conventional Commit was rejected by commitlint, the valid Conventional Commit was accepted, and both runs formatted and re-staged the fixture.
• Validated Husky installer behavior in production, CI, and local environments; production and CI left core.hooksPath unset with no Husky marker, while local installation created .husky/_/h and set core.hooksPath, confirming local hook installation does not affect production.

_{Ran code and verified through T-Rex}

_{Reviews (3): Last reviewed commit: "chore: skip husky install in CI and prod..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	husky@​9.1.7
	@​commitlint/​cli@​21.2.1
	nano-staged@​1.0.2
	@​commitlint/​config-conventional@​21.2.0

View full report

[greptile-apps]

Commit workflow remains undocumented

The new prepare lifecycle installs hooks that format staged files and enforce Conventional Commit messages, but the contributor documentation does not explain this changed workflow or how to resolve hook failures.

Context Used: CLAUDE.md (source)

Prompt To Fix With AI

This is a comment left during a code review.
Path: package.json
Line: 17
Comment:
**Commit workflow remains undocumented**
The new `prepare` lifecycle installs hooks that format staged files and enforce Conventional Commit messages, but the contributor documentation does not explain this changed workflow or how to resolve hook failures.
**Context Used:** CLAUDE.md ([source](https://github.com/wolfstar-project/agent-zero/blob/main/CLAUDE.md))
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!