Add pre-commit hooks for code quality and fix all lint violations

Introduces pre-commit framework with hooks for:
- General file hygiene (trailing whitespace, EOF, large files)
- Secret detection (TruffleHog)
- YAML linting (yamllint)
- Ansible linting (ansible-lint)
- Python linting/formatting (ruff)
- Shell script analysis (shellcheck, shfmt)
- TOML formatting (taplo)
- JSON formatting (prettier)

Fixes 91+ ansible-lint violations:
- Renamed variables to use role prefixes (e.g., brew_start -> alloy_brew_start)
- Capitalized handler names per convention
- Added changed_when to command tasks
- Fixed template usage in task names

Fixes shellcheck warnings:
- Removed unused variables
- Fixed SC2155 (declare and assign separately)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.ansible-lint

@@ -0,0 +1,19 @@
+---
+# Ansible-lint configuration
+
+# Set profile to production for stricter checking
+profile: production
+
+# Exclude paths
+exclude_paths:
+  - .venv/
+  - pulumi/.venv/
+
+# Make ansible-lint aware of project structure
+project_dir: ansible
+
+# Skip some rules that are too noisy for this project
+skip_list:
+  - galaxy  # Don't require galaxy metadata in roles
+  - yaml[line-length]  # Don't enforce line length limits
+  - no-handler  # Some tasks intentionally run conditionally, not as handlers