git-hooks: install no pre-push hook, and prune stale chained shims

[zah]

Every consumer's dev shell installed a prek pre-push shim, because upstream git-hooks.nix gives check-added-large-files the stages [pre-commit pre-push manual]. At pre-push that hook checks nothing: its candidate set is the staged diff, which is empty at push time. But the shim fails the push whenever the pushing checkout's .pre-commit-config.yaml has no pre-push hook ("No hooks found for stage pre-push"), for example a linked worktree or a checkout whose config predates this hook set. In a Reprobuild workspace the shim is chained as pre-push.repro-local, so it also blocked the publication gate. It broke every metacraft-labs/infra push on 2026-10-01 and again on 10-02.

Changes:

• git-hooks/hooks.nix: check-added-large-files runs at pre-commit only. It uses mkOverride 90 because upstream's list is a plain definition, and lists at equal priority concatenate. A consumer can still mkForce a pre-push stage.
• lib/git-hooks-reprobuild-handoff.nix: after an installer run, a generated pre-commit/prek shim chained as <hook>.repro-local for a stage the installer did not install is removed. Existing checkouts therefore drop the stale pre-push shim on their next shell entry. Hand-written .repro-local files are never touched, and an entry where the installer did not run prunes nothing. The Reprobuild dispatcher contract is unchanged.
• checks/git-hooks-reprobuild-handoff.nix: case 6 covers the pruning, the hand-written exception and the no-installer-run case. It fails with the pruning disabled (negative control run locally).

Verification:

• checks.x86_64-linux.git-hooks-reprobuild-handoff: all 6 cases pass (real prek and git).
• A fresh metacraft-labs/infra clone with the workspace's Reprobuild dispatchers copied in.
  • With the current lock, entering the shell installs pre-push.repro-local (prek), with stages pre-commit pre-push manual.
  • With this branch (--override-input nixos-modules), only pre-commit is chained, the stale pre-push shim is removed ("git-hooks: removed .git/hooks/pre-push.repro-local …"), and a commit and a push both run through the dispatchers.

Not covered here: gosti calls upstream's pre-commit-check.shellHook directly, without this module's installer or handoff, so its dev shell still moves Reprobuild dispatchers to .legacy. Fixing that means adopting the handoff there; it is a separate change.

[github-actions]

Thanks for your Pull Request!

Below you will find a summary of the cachix status of each package, for each supported platform.

package	x86_64-linux	x86_64-darwin	aarch64-darwin
attic-migrate-flake	✅ Cached at <0>	🚫 not supported	❌ build failed
attic-migrate-flake-idempotent	✅ Cached at <0>	🚫 not supported	❌ build failed
attic-push-flake-outputs-action	✅ Cached at <0>	🚫 not supported	❌ build failed
aztec	✅ Cached at <0>	🚫 not supported	❌ build failed
cachix	✅ Cached at <0>	🚫 not supported	❌ build failed
cachix-deploy-metrics	✅ Cached at <0>	🚫 not supported	❌ build failed
ci-build-batching	✅ Cached at <0>	🚫 not supported	❌ build failed
ci-image	✅ Cached at <0>	🚫 not supported	🚫 not supported
consumer-flake-cachix-inventory	✅ Cached at <0>	🚫 not supported	❌ build failed
consumer-flake-cachix-inventory-tool	✅ Cached at <0>	🚫 not supported	❌ build failed
consumer-flake-no-cachix-residual	✅ Cached at <0>	🚫 not supported	❌ build failed
consumer-flake-no-cachix-residual-tool	✅ Cached at <0>	🚫 not supported	❌ build failed
dcd	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-attic-nginx-logs-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-attic-push-substitute-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-break-glass-runbook-sections	✅ Cached at <0>	🚫 not supported	❌ build failed
deployment-cache-backend-policy	✅ Cached at <0>	🚫 not supported	❌ build failed
deployment-cache-corruption-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-cachix-fallback-simulation	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-current-flow-inventory	✅ Cached at <0>	🚫 not supported	❌ build failed
deployment-darwin-activation-integration	✅ Cached at <0>	🚫 not supported	❌ build failed
deployment-dashboard-query-fixtures	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-direct-ssh-attic-restore-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-direct-ssh-rollback-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-direct-ssh-success-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-e2e-rehearsal-skill-doc	✅ Cached at <0>	🚫 not supported	❌ build failed
deployment-event-metrics	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-event-schema-examples	✅ Cached at <0>	🚫 not supported	❌ build failed
deployment-incus-rehearsal-image	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-incus-rehearsal-script-static	❌ build failed	🚫 not supported	🚫 not supported
deployment-metrics-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-no-default-cachix-deploy-call	❌ build failed	🚫 not supported	🚫 not supported
deployment-parallel-cache-push-local	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-production-cutover-simulation-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-pull-agent-darwin-integration	🚫 not supported	🚫 not supported	❌ build failed
deployment-pull-agent-latest-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-pull-agent-lock-contention-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-pull-agent-locks-migration-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-pull-agent-rejects-invalid-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-pull-agent-selfheal-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-pull-agent-static	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-reconciler-lock-contention-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-reconciler-skill-doc	✅ Cached at <0>	🚫 not supported	❌ build failed
deployment-reconciler-supersession-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-reconciler-timer-retry-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-reconciler-timer-static	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-scheduled-canary-local-vm	✅ Cached at <0>	🚫 not supported	🚫 not supported
deployment-skill-doc-command-references	✅ Cached at <0>	🚫 not supported	❌ build failed
deployment-summary-artifact	✅ Cached at <0>	🚫 not supported	❌ build failed
desktop-vms-golden	✅ Cached at <0>	🚫 not supported	🚫 not supported
disko	✅ Cached at <0>	🚫 not supported	🚫 not supported
dmd	✅ Cached at <0>	🚫 not supported	🚫 not supported
dscanner	✅ Cached at <0>	🚫 not supported	🚫 not supported
dub	✅ Cached at <0>	🚫 not supported	❌ build failed
encrypted-s3-artifact	✅ Cached at <0>	🚫 not supported	❌ build failed
erigon	✅ Cached at <0>	🚫 not supported	🚫 not supported
fleet-alertmanager-config	✅ Cached at <0>	🚫 not supported	❌ build failed
fleet-alertmanager-config-deadman	✅ Cached at <0>	🚫 not supported	❌ build failed
folder-size-metrics	✅ Cached at <0>	🚫 not supported	🚫 not supported
foundry	✅ Cached at <0>	🚫 not supported	❌ build failed
garm	✅ Cached at <0>	🚫 not supported	❌ build failed
garm-fleet-alert-rules	✅ Cached at <0>	🚫 not supported	❌ build failed
garm-fleet-external-checks	✅ Cached at <0>	🚫 not supported	❌ build failed
garm-provider-agentharbor	✅ Cached at <0>	🚫 not supported	❌ build failed
garm-provider-aws	✅ Cached at <0>	🚫 not supported	❌ build failed
garm-provider-vmharness	✅ Cached at <0>	🚫 not supported	✅ Cached at <0>
geth	✅ Cached at <0>	🚫 not supported	❌ build failed
git-hooks-reprobuild-handoff	❌ build failed	🚫 not supported	❌ build failed
git-hooks-same-repo-git	✅ Cached at <0>	🚫 not supported	❌ build failed
github-actions-fit-alert-rules	✅ Cached at <0>	🚫 not supported	❌ build failed
github-actions-fit-exporter	✅ Cached at <0>	🚫 not supported	❌ build failed
ldc	✅ Cached at <0>	🚫 not supported	🚫 not supported
lido-withdrawals-automation	✅ Cached at <0>	🚫 not supported	❌ build failed
linux-vm-cloud-init-image	✅ Cached at <0>	🚫 not supported	🚫 not supported
mcl-devops	✅ Cached at <0>	🚫 not supported	✅ Cached at <0>
mcl-devops-no-stale-references	❌ build failed	🚫 not supported	❌ build failed
mcl-devops-single-bin-mcl-provider	✅ Cached at <0>	🚫 not supported	❌ build failed
mev-boost	✅ Cached at <0>	🚫 not supported	🚫 not supported
netbird-with-agenix-login-script	✅ Cached at <0>	🚫 not supported	🚫 not supported
nethermind	✅ Cached at <0>	🚫 not supported	🚫 not supported
nimbus	✅ Cached at <0>	🚫 not supported	🚫 not supported
nix	✅ Cached at <0>	<1>	🚫 not supported
nix-eval-jobs	✅ Cached at <0>	<1>	🚫 not supported
nix-fast-build	✅ Cached at <0>	🚫 not supported	✅ Cached at <0>
nixos-anywhere	✅ Cached at <0>	🚫 not supported	🚫 not supported
nixos-rebuild-ng	✅ Cached at <0>	🚫 not supported	❌ build failed
pyroscope	✅ Cached at <0>	🚫 not supported	❌ build failed
random-alerts	✅ Cached at <0>	🚫 not supported	❌ build failed
reusable-flake-checks-artifact-fallback	✅ Cached at <0>	🚫 not supported	❌ build failed
reusable-flake-checks-attic-credentials	✅ Cached at <0>	🚫 not supported	❌ build failed
reusable-flake-checks-mcl-ref	✅ Cached at <0>	🚫 not supported	❌ build failed
reusable-flake-checks-s3-mirror-compat	✅ Cached at <0>	🚫 not supported	❌ build failed
reusable-lint-hook-discovery	✅ Cached at <0>	🚫 not supported	❌ build failed
reusable-terraform-drift-workflow	✅ Cached at <0>	🚫 not supported	❌ build failed
reusable-terraform-policy-advisories	❌ build failed	🚫 not supported	❌ build failed
reusable-terraform-source-identity	❌ build failed	🚫 not supported	❌ build failed
runner-label-tool	✅ Cached at <0>	🚫 not supported	❌ build failed
rustToolchain	✅ Cached at <0>	🚫 not supported	❌ build failed
seal-alerting-secrets	✅ Cached at <0>	🚫 not supported	❌ build failed
secret-integration	✅ Cached at <0>	🚫 not supported	🚫 not supported
serve-d	✅ Cached at <0>	🚫 not supported	🚫 not supported
setup-nix-hosted-disk-reclamation	✅ Cached at <0>	🚫 not supported	❌ build failed
setup-nix-substituter-preflight	✅ Cached at <0>	🚫 not supported	❌ build failed
setup-nix-transfer-resilience	✅ Cached at <0>	🚫 not supported	❌ build failed
t_aws_burst_runners	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_aws_spot_runners	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_central_garm_recovery	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_ci_runs_on_capability	✅ Cached at <0>	🚫 not supported	❌ build failed
t_cross_host_publish_substitute	❌ build failed	🚫 not supported	🚫 not supported
t_fit_exporter_repos_env_roundtrip	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_fleet_alert_routing	✅ Cached at <0>	🚫 not supported	❌ build failed
t_fleet_alerting	✅ Cached at <0>	🚫 not supported	❌ build failed
t_garm_api_watchdog	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_busy_runner_not_reaped	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_capability_placement	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_central_multi_host	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_credentials_no_race	❌ build failed	🚫 not supported	🚫 not supported
t_garm_deleting_capacity	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_incus_runner_host	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_incus_storage_pool_source	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_instance_lifecycle	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_job_cache_self_heal	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_macos_pools_supported	✅ Cached at <0>	🚫 not supported	❌ build failed
t_garm_macos_runner_install_wrapper	✅ Cached at <0>	🚫 not supported	❌ build failed
t_garm_multi_provider	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_nixos_service_boots	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_pools_labels	❌ build failed	🚫 not supported	🚫 not supported
t_garm_provider_agentharbor	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_provider_agentharbor_module	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_provider_remote	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_provider_remote_old_daemon	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_provider_vmharness_backend	✅ Cached at <0>	🚫 not supported	❌ build failed
t_garm_provider_vmharness_protocol	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_provider_vmharness_windows_toolchain	✅ Cached at <0>	🚫 not supported	❌ build failed
t_garm_reconcile	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_remote_incus_capabilities	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_remote_libvirt_settings	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_stale_scaleset_job_reaped	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_garm_webhook_delivery	❌ build failed	🚫 not supported	🚫 not supported
t_pools_cutover_complete	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_private_repo_hybrid_fallback	✅ Cached at <0>	🚫 not supported	❌ build failed
t_public_repo_free_ci	✅ Cached at <0>	🚫 not supported	❌ build failed
t_repro_binary_cache_systemd_healthz	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_repro_cache_client_render	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_repro_deploy_agent_https_converges	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_repro_lease_reaper_eval	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_runner_fit_monitoring	✅ Cached at <0>	🚫 not supported	❌ build failed
t_runner_label_taxonomy	✅ Cached at <0>	🚫 not supported	❌ build failed
t_runner_mode_manager	✅ Cached at <0>	🚫 not supported	❌ build failed
t_runner_mode_switch	✅ Cached at <0>	🚫 not supported	❌ build failed
t_s3_artifact_store_acl_and_creds	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_vmharness_create_fails_on_dead_guest	✅ Cached at <0>	🚫 not supported	❌ build failed
t_vmharness_image_is_honoured	✅ Cached at <0>	🚫 not supported	❌ build failed
t_vmharness_serve_inventory_textfile	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_vmharness_serve_linux_deploy	✅ Cached at <0>	🚫 not supported	🚫 not supported
t_vmharness_serve_win_libvirt	✅ Cached at <0>	🚫 not supported	🚫 not supported
terraform	✅ Cached at <0>	🚫 not supported	🚫 not supported
terraform-ci-matrix	✅ Cached at <0>	🚫 not supported	❌ build failed
terranix	✅ Cached at <0>	🚫 not supported	🚫 not supported
test-linux-vm-cloud-init	✅ Cached at <0>	🚫 not supported	🚫 not supported
test_darwin_pull_agent_already_current_is_transaction_free	🚫 not supported	🚫 not supported	❌ build failed
test_darwin_pull_agent_already_current_recovers_lifecycle_before_convergence	🚫 not supported	🚫 not supported	❌ build failed
test_darwin_pull_agent_assertion_gate	🚫 not supported	🚫 not supported	❌ build failed
test_darwin_pull_agent_entrypoint_survives_generation_change	🚫 not supported	🚫 not supported	❌ build failed
test_darwin_pull_agent_launchd_contract	🚫 not supported	🚫 not supported	❌ build failed
test_darwin_pull_agent_lock_contention_is_non_destructive	🚫 not supported	🚫 not supported	❌ build failed
test_darwin_pull_agent_recreates_missing_lock_dir	✅ Cached at <0>	🚫 not supported	❌ build failed
test_darwin_pull_agent_rejects_invalid_durable_state	🚫 not supported	🚫 not supported	❌ build failed
test_darwin_pull_agent_rejects_untrusted_and_wrong_target_manifests	🚫 not supported	🚫 not supported	❌ build failed
test_darwin_pull_agent_same_id_sequence_high_water	🚫 not supported	🚫 not supported	❌ build failed
vm-harness	✅ Cached at <0>	🚫 not supported	❌ build failed
vmharness-serve-darwin-posture	✅ Cached at <0>	🚫 not supported	❌ build failed
web3signer	✅ Cached at <0>	🚫 not supported	🚫 not supported
yaml-automation-runner	✅ Cached at <0>	🚫 not supported	🚫 not supported