Merge remote-tracking branch 'origin/ci'

# Conflicts:
#	CHANGELOG.md

docs/DEVOPS.md

@@ -95,6 +95,46 @@ CI targets chain lint → build → test sequentially. A failure in any stage st
 make clean              # Remove build artifacts and .cache/ contents
 ```
 
+### Content Validation
+
+```bash
+make validate-content     # Validate content YAML against JSON schemas
+make check-fact-ids       # Check fact_id references against knowledge catalogs
+```
+
+`check-fact-ids` operates in two modes:
+- **Advisory** — when knowledge catalogs (`content/global/knowledge/*.yaml`) have no fact definitions yet: lists referenced fact_ids and exits cleanly.
+- **Enforcing** — when catalogs are populated: fails on any `fact_id` reference that doesn't match a canonical definition.
+
+## Pre-commit Hooks
+
+Git hooks are stored in `.config/hooks/` (version-controlled). Activate them with:
+
+```bash
+make setup          # Includes hook installation
+make setup-hooks    # Just hooks
+```
+
+Or manually:
+
+```bash
+git config core.hooksPath .config/hooks
+```
+
+Active checks:
+
+| Check | Script | Behavior |
+|-------|--------|----------|
+| fact_id validation | `tooling/check-fact-ids` | Warns if catalogs are stubs; fails on unknown fact_ids when populated |
+
+The `core.hooksPath` setting uses a relative path (`.config/hooks`) that resolves per worktree, so it works correctly across all worktrees in the repository.
+
+To bypass hooks in an emergency:
+
+```bash
+git commit --no-verify -m "fix: emergency hotfix"
+```
+
 ## Configuration Files
 
 The `.config/` directory holds shared configuration for linters, formatters, and CI. Examples of what goes here: