ci: Enforce local linting and commit conventions via pre-commit hooks

[ntkathole]

What this PR does / why we need it:

Contributors could push code and open PRs without any local linting or
commit message validation if they hadn't manually installed pre-commit
hooks. Specifically:

• make install-python-dependencies-dev (the standard dev setup command)
  did not install pre-commit hooks, so most contributors never had
  them active.
• make install-precommit only registered the pre-commit hook type,
  meaning the commitlint hook (which requires commit-msg stage) and
  any push-time checks were never wired up — even for contributors who
  ran make install-precommit explicitly.
• There was no push-time gate, so bad formatting could reach the remote
  even if the commit-time hook was bypassed (e.g. --no-verify).

---