Switch git hooks from pre-commit to prek (#276)

## Summary

- Replace pre-commit with [prek](https://github.com/j178/prek), a faster Rust-native drop-in alternative
- Migrate config from `.pre-commit-config.yaml` (YAML) to `prek.toml` (TOML)
- Add new built-in checks: case conflicts, private key detection, executable shebangs
- Install prek via mise native registry (`aqua:j178/prek`) instead of pipx
- Update all doc references across README, contributing guide, and how-to docs

## Notes

- `check-yaml` still uses the remote `pre-commit-hooks` repo because prek's builtin fast path doesn't support `--unsafe` yet (needed for Ansible custom YAML tags)
- All existing custom hooks (docs validation, container version check, mikado invariant, workflow validation) work unchanged
- Tested: all hooks pass on clean tree, deliberate doc link breakage is caught

## Test plan

- [x] `prek run --all-files` passes all checks
- [x] Broken wiki-link correctly caught by `docs-check-links`
- [x] taplo-format auto-fixes TOML formatting on commit
- [x] commit-msg hook (mikado invariant) fires correctly

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/276

docs/tutorials/contributing.md

@@ -27,7 +27,7 @@ The repo includes a `Brewfile` and `mise.toml` for easy setup, but these are opt
 
 - `tea` - Gitea/Forgejo CLI for creating PRs
 - `argocd` - ArgoCD CLI for deployments
-- `pre-commit` - Git hooks for validation
+- `prek` - Git hooks for validation
 
 ### Using Brewfile (Optional)
 
@@ -42,12 +42,12 @@ Mise manages language toolchains and runs tasks:
 mise install  # installs Python, Node.js, etc. from mise.toml
 ```
 
-### Pre-commit Hooks
+### Git Hooks (prek)
 
-Pre-commit hooks validate changes on `git commit`:
+Git hooks validate changes on `git commit`:
 ```bash
-pre-commit install
-pre-commit run --all-files  # verify setup
+prek install
+prek run --all-files  # verify setup
 ```
 
 All hooks should pass on a fresh clone.