Rework pre-commit hook for virtualization gate

[jserv]

This redesigns the pre-commit hook drawing on patterns. The hook now blocks commits from VMs while explicitly allowing containers, and all code-quality checks operate on staged content rather than the working tree.

Change-Id: I39883a6f85746e22037fa2b71644c1ff3468e21e

---

Summary by cubic

Reworks the pre-commit hook to enforce a virtualization gate (blocks VMs, allows containers) and run all checks against staged content. Tightens C/C++ style to clang-format-20, adds banned-function scanning on added lines, and improves feedback.

• New Features

  • Blocks commits when a hypervisor is detected; containers are allowed; auto-skips on GitHub Actions.
  • Runs clang-format-20, cppcheck, and shfmt on staged files only.
  • Requires clang-format-20; rejects other versions of clang-format.
  • Flags newly added uses of gets, sprintf/vsprintf, strcpy/stpcpy, and strcat.
  • Shows concise progress, errors, and fix suggestions.

• Migration

  • Do not commit from a VM; use a physical host or a container.
  • Install clang-format-20, cppcheck, and shfmt.
  • To fix formatting: run clang-format -i <file> and shfmt -w <file>.

^{Written for commit 0000492. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file