chore: adopt make pre-commit workflow with full pre-commit hook suite

[Lang-Akshay]

Closes IBM/mcp-context-forge#5960

Summary

Adopts the make pre-commit workflow for the data-plane repo, mirroring the ContextForge control-plane pre-commit setup.

Changes

• .pre-commit-config.yaml — full hook suite: private key detection, large-file guard, merge-conflict check, end-of-file / trailing-whitespace / encoding fixers, BiDi control forbid, AI-slop guards, IBM detect-secrets, and Rust hooks (cargo fmt, clippy, deny, nextest, build). All revs pinned to commit SHAs. End-of-file fixer excludes .gitignore (intentionally no trailing newline).
• Makefile — make pre-commit target: runs the full suite hermetically with PRE_COMMIT_HOME and TMPDIR redirected under .cache/ (nothing written to ~).
• .secrets.baseline — generated baseline for IBM detect-secrets covering dev TLS/JWT keys in assets/, test fixture secrets, and scanner test-vector strings inside cpex-secrets-detection.
• scripts/git/resolve-secrets-baseline-conflict.sh — merge driver that regenerates the baseline on conflict, excludes the baseline from its own scan, preserves audit decisions, and rejects unaudited findings.
• scripts/git/test-resolve-secrets-baseline-conflict.sh — focused regression test covering successful regeneration, audit preservation, baseline exclusion, and fail-closed rejection.
• .gitignore — adds .cache/ (pre-commit home, venvs, tmp).
• .gitattributes — marks generated/binary files for diff hygiene.

Acceptance

• make pre-commit runs the full suite against all files and passes on a clean tree.
• The focused secrets-baseline merge-driver regression test passes.
• All hook revs pinned to SHAs.
• Caches land under .cache/ — nothing written to ~.
• Re-running is idempotent; formatter changes require re-staging.

[lucarlig]

Requesting changes based on a full review of the PR:

1. Docker image mismatch: make docker-prod builds and testing-up validates dataplane:latest, but docker/docker-compose.yml still resolves all three data-plane services to contextforge-data-plane:latest. This can launch a stale image or fail to pull. Please keep the Makefile and Compose image contract aligned.

2. Secret scanning is fail-open: the baseline contains 42 findings with no is_secret audit decisions, while the detect-secrets hook omits --fail-on-unaudited. The merge driver also regenerates the baseline and exits successfully without rejecting unaudited/live findings. Please audit the baseline, enable the unaudited gate, and make the merge path fail closed.

3. Merge-driver setup is missing: .gitattributes instructs contributors to run make configure-git, but that target does not exist. Please add the configuration target or remove the unusable merge-driver integration.

4. Makefile default regression: removing help makes docker-prod the default target, so plain make now starts a Docker build and make help fails. Please restore a safe help/default target.

5. Hermeticity claim is incomplete: only PRE_COMMIT_HOME and TMPDIR are redirected; Cargo-based hooks can still write under CARGO_HOME (~/.cargo) on an uncached machine. Please redirect the relevant caches or adjust the stated acceptance criteria.

I reproduced the Compose image resolution and Makefile behavior. The complete pre-commit suite and current GitHub CI pass, but they do not catch the behavioral and fail-open issues above.

[Lang-Akshay]

Thanks for the review @lucarlig
All findings addressed in ee86520:

• ✅ Docker image mismatch — Introduced IMAGE_NAME variable in Makefile; Compose already uses ${IMAGE_LOCAL:-contextforge-data-plane:latest}. Both resolve to the same image.
• ✅ Secret scanning fail-open — Added --fail-on-unaudited to the detect-secrets hook. All 45 baseline findings audited (is_secret: false). Merge driver now fails closed on unaudited findings.
• ✅ Merge-driver setup missing — Added make configure-git target that registers the secrets-baseline merge driver.
• ✅ Makefile default regression — Restored help as the first (default) target. make and make help both work.
• ✅ Hermeticity claim incomplete — CARGO_HOME now redirected to .cache/cargo alongside PRE_COMMIT_HOME and TMPDIR in the pre-commit target.

[lucarlig]

Re-review of cd391e1: the Docker image contract, audited baseline, normal detect-secrets hook, configure-git, safe default Make target, and cache redirection are fixed. The direct detect-secrets hook now passes and leaves the baseline unchanged. One blocker remains in the secrets-baseline merge driver (inline). I reproduced it independently; the current green checks do not exercise this path. Please fix the regex, exclude .secrets.baseline, and verify the merge driver can regenerate a baseline successfully while still rejecting genuinely unaudited findings. Please also update the PR description: it still says the pre-commit suite includes cargo bench, but that hook has been removed.

[lucarlig]

LGTM