chore(ci): generator-driven asset pipeline — meta stamp + hook + regen target

Adds systems.db regeneration discipline (#855) via a `meta` table (#856)
stamped by every generator, a pre-push hook that rejects stale DBs (#857),
and the top-level `make regen-db` / `make check-systems-db` targets that
drive the whole pipeline.

The stamp stores SHA-1 of generator source + schema, so the pre-push hook
can cheaply detect "you changed a generator but forgot to regen the DB"
before a binary merge conflict lands. Sprint 36 hit that class of conflict
on two branches touching systems.db simultaneously — this is the systemic
fix.

Regenerated systems.db is stamped; `make check-systems-db` passes.

Refs: #855 #856 #857

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.config/hooks/pre-push

@@ -138,6 +138,40 @@ else
     echo "pre-push: no JSON changes — skipping"
 fi
 
+# --- systems.db stamp check (#857) ---
+# If server/data/systems.db is in the commits being pushed and its meta
+# table shows a generator SHA mismatch, reject the push.  This prevents
+# pushing a stale DB snapshot where generator source was modified but the
+# DB was not regenerated.
+#
+# Only runs when there is a known remote ref (i.e. the branch has been
+# pushed before).  Skipped for brand-new branches — the developer is
+# setting up the tracking branch for the first time, and we cannot diff
+# against a ref that doesn't exist yet.
+if git rev-parse --verify "$REMOTE_REF" >/dev/null 2>&1; then
+    DB_IN_PUSH=$(git diff --name-only "$REMOTE_REF"..HEAD -- server/data/systems.db 2>/dev/null | wc -l)
+else
+    DB_IN_PUSH=0  # new branch — skip stamp check
+fi
+if [ "$DB_IN_PUSH" -gt 0 ] && [ -f "$REPO_ROOT/tooling/check-systems-db-stamp" ]; then
+    echo "pre-push: checking systems.db stamp..."
+    rc=0
+    python3 "$REPO_ROOT/tooling/check-systems-db-stamp" || rc=$?
+    if [ "$rc" -eq 1 ]; then
+        # rc=1 means stale; error message already printed to stderr
+        echo "  Fix: run 'make regen-db' then stage server/data/systems.db"
+        echo "  Or use /pr-push — it handles regen automatically before pushing."
+        ERRORS=$((ERRORS + 1))
+    elif [ "$rc" -eq 2 ]; then
+        # rc=2 means no meta table — treat as unstamped, warn but don't block
+        echo "pre-push: WARNING — systems.db has no meta stamp; run 'make regen-db' after next regeneration"
+    else
+        echo "pre-push: systems.db stamp — OK"
+    fi
+else
+    echo "pre-push: systems.db not in push — skipping stamp check"
+fi
+
 if [ "$ERRORS" -gt 0 ]; then
     echo ""
     echo "pre-push: $ERRORS check(s) failed. Push aborted."