feat(ci): add ci_checks.py sanity gate and a worktree-safe hook installer

[marcoaperez]

Motivated by a real incident: a single missing comma silently turned step-catalog-en.json into invalid JSON, and nothing caught it before it reached collaborators — every tool that loads the catalog broke at once.

What this adds

• agent/scripts/ci_checks.py validates that every agent/catalogs/*.json parses, then runs the converter tests and the fmlint test suite. Exit 0/1, --quick for the catalog-only fast path. Runnable by hand, from a git hook, or from CI.
• agent/scripts/hooks/pre-push runs ci_checks.py automatically whenever a push touches a critical artifact (a catalog, the SaXML/HR converters, or fmlint itself), and blocks the push if anything fails. Emergency bypass via git push --no-verify.
• agent/scripts/install-hooks.sh installs the hooks, resolving the hooks directory via git rev-parse --git-common-dir instead of assuming .git/hooks — a plain .git assumption fails inside a git worktree, where .git is a pointer file and the real hooks directory lives in the main checkout.

Test plan

• ci_checks.py --quick correctly flags the catalog JSON bug currently on main (see feat(fmlint): add param-fidelity rules to catch silent-discard params (X001-X003) #72) as FAIL
• ci_checks.py (full) runs converter + fmlint test suites
• install-hooks.sh run from inside a git worktree correctly installs into the main checkout's .git/hooks/, not a worktree-local path
• pre-push correctly no-ops when the push doesn't touch a critical path, and triggers ci_checks.py when it does

[agentic-fm]

Thanks for this, @marcoaperez — the intent is exactly right, and I confirmed the value: check_catalogs() catches invalid catalog JSON before it reaches collaborators, which is precisely the failure that recently broke the linter for everyone. I want this in.

One structural change before merge — placement:

• agent/scripts/ is reserved for agent/LLM-operation scripts (e.g. analyze.py, clipboard.py, companion_server.py, deploy.py). Repo-level CI / developer tooling like this doesn't belong there.
• Please move all three into a new top-level scripts/ folder at the repo root:
  • scripts/ci_checks.py
  • scripts/hooks/pre-push
  • scripts/install-hooks.sh
• Add a scripts/AGENTS.md that documents what each script does and, importantly, how to wire the hooks up — install-hooks.sh usage, what pre-push gates on, and the --no-verify emergency bypass. Please write it as actionable setup instructions: in most cases it will be an agent wiring this up in a collaborator's clone, and without that doc the scripts just sit there unused. (Folder-scoped AGENTS.md is picked up by AGENTS.md-aware tools; note the repo-root AGENTS.md is a symlink to the canonical instructions, so keep this one specific to the scripts/ folder.)

Once relocated with that AGENTS.md, this is good to merge. Appreciate you closing the gap that bit us. 🙏