chore(config): wire pql hooks + Makefile decision targets (pql migration phase 4)

Folds pql's planning logic into the version-controlled .config/hooks/* (pql's own
.pql/hooks installer is dead under core.hooksPath=.config/hooks):

  - pre-commit: + `pql decisions validate` (decision-ID/format gate, supersedes the
    never-built check-decision-ids TODO) and `pql plan export --stage` (flush ticket
    mutations to the git-tracked changelog and stage them into the commit). Both
    guarded by `command -v pql`; export is a clean no-op when nothing changed.
  - post-merge: `pql plan import` + `pql decisions sync` (replay incoming changelog,
    re-sync markdown decisions).
  - post-checkout (branch only): `pql plan rebuild` + `decisions sync`.
  - post-rewrite (rebase/amend): `pql plan rebuild`.
  - install-hooks chmods the three new hooks.

Makefile decision targets repointed to pql: decisions-sync -> `pql decisions sync`,
decisions-active -> `pql decisions list --type confirmed`, new decisions-validate ->
`pql decisions validate`. Dropped the SQLite-query conveniences (coverage/orphan/
orphan-tickets); per-decision coverage is `pql decisions show <id> --with-tickets`.

db-backup/db-install and SR_DB_PATH are intentionally kept until Phase 6 so the
legacy SQLite store stays intact as the migration rollback path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.config/hooks/post-checkout

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Post-checkout hook. Folds in pql's planning logic (its .pql/hooks installer is
+# dead under core.hooksPath=.config/hooks).
+#
+# On a branch checkout (third arg == 1), rebuild pql.db from the changelog so the
+# local planning cache reflects the new branch's state. File-level checkouts
+# ($3 == 0) are skipped. Args: <prev-HEAD> <new-HEAD> <branch-flag>.
+if [ "${3:-0}" = "1" ] && command -v pql >/dev/null 2>&1; then
+    pql plan rebuild >/dev/null 2>&1 || true
+    pql decisions sync >/dev/null 2>&1 || true
+fi

.config/hooks/post-merge

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Post-merge hook (also fires after `git pull`). Folds in pql's planning logic;
+# pql's own .pql/hooks installer is dead under core.hooksPath=.config/hooks.
+#
+# Replays any changelog files the merge brought in (idempotent, LWW — D-16) and
+# re-syncs decisions from governance/*.md so the markdown-sourced half stays in
+# step. Both are no-ops when nothing changed.
+if command -v pql >/dev/null 2>&1; then
+    pql plan import >/dev/null 2>&1 || true
+    pql decisions sync >/dev/null 2>&1 || true
+fi

.config/hooks/post-rewrite

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Post-rewrite hook (fires after `git rebase` / `git commit --amend`). Folds in
+# pql's planning logic; its .pql/hooks installer is dead under
+# core.hooksPath=.config/hooks.
+#
+# Rewriting history can reorder or drop changelog edits, so a full rebuild from
+# the changelog is the safe, deterministic refresh (incremental replay would miss
+# removals — D-16).
+if command -v pql >/dev/null 2>&1; then
+    pql plan rebuild >/dev/null 2>&1 || true
+fi

.config/hooks/pre-commit

@@ -21,8 +21,24 @@ run_check() {
 
 # --- Checks ---
 run_check "tooling/check-fact-ids" "fact_id validation"
-# TODO: uncomment when tooling/check-decision-ids is implemented
-# run_check "tooling/check-decision-ids" "decision ID duplication"
+
+# --- pql: decision integrity + durable planning changelog ---
+# Replaces the old SQLite decisions-sync hook. Decisions are markdown-sourced (D-8):
+# `decisions validate` is the decision-ID/format gate (supersedes the never-built
+# check-decision-ids), and `plan export --stage` flushes any ticket mutations to the
+# git-tracked .pql/changelog/ and stages them so planning state lands in this commit.
+# pql installs its own hooks into .pql/hooks, which git ignores under
+# core.hooksPath=.config/hooks — so the logic is folded in here by hand instead.
+if command -v pql >/dev/null 2>&1; then
+    if ! pql decisions validate >/dev/null; then
+        echo "pre-commit: pql decisions validate failed — malformed decision record(s)."
+        ERRORS=$((ERRORS + 1))
+    fi
+    pql plan export --stage >/dev/null 2>&1 || \
+        echo "pre-commit: WARNING — pql plan export failed; changelog not refreshed."
+else
+    echo "pre-commit: WARNING — pql not on PATH; decision validate + changelog export skipped."
+fi
 
 # Run cargo audit only when Cargo.toml or Cargo.lock changed
 if git diff --cached --name-only | grep -qE '(Cargo\.toml|Cargo\.lock)$'; then