feat: replace shell pre-commit hook with Python-based unified scanner

[rocklambros]

Problem

The current pre-commit hook (.zerg/hooks/pre-commit, 390 lines) is a shell script that duplicates security patterns already defined in the Python pattern registry (security/patterns.py, 1017 lines). This creates two problems:

1. Pattern drift — changes to PATTERN_REGISTRY don't update the shell hook, and vice versa
2. Weaker detection — shell hook uses basic grep, missing the AST-aware analysis now available via semgrep integration

Additionally, install_hooks() in security/hooks.py is dead code — it's never called, so the hook isn't even installed automatically.

Proposed Solution

Replace the shell pre-commit hook with a Python entry point that calls the unified scanner:

# .git/hooks/pre-commit (or via .pre-commit-config.yaml)
python -m zerg.security.scanner --pre-commit

Behavior

1. Collect staged files via git diff --cached --name-only
2. Call run_security_scan(files=staged_files) — runs semgrep + regex + CVE scan
3. Security findings (severity >= HIGH) → block commit, show findings
4. Quality findings (severity < HIGH) → warn, allow commit
5. Exit code 0 = pass, exit code 1 = blocked
6. Log all findings to .zerg/security/findings.json

Migration

• Remove .zerg/hooks/pre-commit shell script (390 lines)
• Remove HOOK_PATTERNS dict from scanner.py (duplicated patterns)
• Update security/hooks.py:install_hooks() to install the Python hook
• Actually call install_hooks() during zerg init
• Add zerg.security.scanner as a local pre-commit hook in .pre-commit-config.yaml

Files to Modify

File	Change
zerg/security/scanner.py	Add --pre-commit CLI mode, remove HOOK_PATTERNS
zerg/security/hooks.py	Update to install Python hook instead of shell script
zerg/commands/init.py	Call install_hooks() during init
.zerg/hooks/pre-commit	Delete (replaced by Python entry point)
.pre-commit-config.yaml	Add local hook for zerg.security.scanner

Acceptance Criteria

• Shell pre-commit hook replaced with Python entry point
• HOOK_PATTERNS removed from scanner.py (patterns unified in PATTERN_REGISTRY)
• Pre-commit runs semgrep + regex + CVE scan on staged files
• Security violations block commit; quality issues warn only
• install_hooks() called during zerg init
• Backward compatible: existing .pre-commit-config.yaml hooks still work

Depends On

• Unified scanner (feat: unified security scanner — integrate semgrep as primary SAST backend #228)