Severity: High · Domain: CI / hooks

Merges 4 git-hook / CI hygiene findings under one tracking item.

Sub-findings rollup

Why merged

All four are git-hook / CI hygiene items concentrated in scripts/hooks/ + .github/workflows/; a single sweep is more efficient than 4 separate PRs.

Combined fix plan

1. NUL-delimited xargs for the rustfmt staged-files loop:

   git diff --cached --name-only --diff-filter=ACM -z \
     | grep -z '\.rs$' \
     | xargs -0 -r rustfmt --check --edition 2021

2. shasum / sha256sum interop:

   sha256() { command -v sha256sum >/dev/null && sha256sum "$@" || shasum -a 256 "$@"; }

3. pre-push file: either actually implement pre-push and commit it to scripts/hooks/pre-push (preferred — runs cargo clippy --workspace --all-targets -- -D warnings + openapi/SDK drift), or delete its description from CLAUDE.md.
4. Wire detect-secrets into CI: add .github/workflows/secrets.yml running detect-secrets scan --baseline .secrets.baseline; fail the PR on diff.

Tests

• scripts/tests/pre-commit-spaces.sh: stage with space.rs containing bad formatting; the hook rejects.
• scripts/tests/pre-commit-sha-fallback.sh: mock shasum out of PATH → openapi check still runs.
• pre-push file exists + CI assertion.
• A deliberate secret-bearing commit makes the secrets workflow fail.