ci: add local pre-push gate (ruff + mypy + pytest)

Forgejo Actions is not enabled on the instance, so run the same checks
locally before pushing:

- scripts/check.sh runs ruff, mypy, and pytest (mirrors the CI workflow).
- .githooks/pre-push invokes it; enable per clone with
  `git config core.hooksPath .githooks`. Bypass with `git push --no-verify`.
- Fix the pytest invocation in the CI workflow (and document it): use
  `python -m pytest` so the repo root is on sys.path, otherwise the test
  modules fail to `import tests.*`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/check.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+#
+# Local CI gate: lint + type-check + tests. Mirrors .forgejo/workflows/ci.yml
+# so the same checks run before a push even without a Forgejo Actions runner.
+#
+# Run manually:            scripts/check.sh
+# Run automatically:       git config core.hooksPath .githooks   (see .githooks/pre-push)
+# Bypass once (emergency): git push --no-verify
+#
+set -uo pipefail
+
+cd "$(git rev-parse --show-toplevel)" || exit 1
+
+# Prefer the project venv's tools if present, else fall back to PATH.
+BIN=""
+if [ -x ".venv/bin/ruff" ]; then BIN=".venv/bin/"; fi
+
+fail=0
+run() {
+  local label=$1; shift
+  echo "== ${label} =="
+  if "$@"; then
+    echo "  OK"
+  else
+    echo "  FAILED"
+    fail=1
+  fi
+}
+
+run "ruff (lint)"      "${BIN}ruff" check src/ tests/
+run "mypy (types)"     "${BIN}mypy"
+# Use `python -m pytest` (not the pytest console script) so the repo root is on
+# sys.path — the test modules import `from tests.test_docker_ops import ...`.
+run "pytest (tests)"   "${BIN}python" -m pytest -q
+
+echo
+if [ "$fail" -ne 0 ]; then
+  echo "CI gate FAILED — fix the above or push with --no-verify to bypass."
+  exit 1
+fi
+echo "CI gate passed."