feat(ci): add pre-commit FactId validation hook (#393)

Grep-based pre-commit check validating fact_id references in content
YAML against canonical knowledge catalogs. Runs in advisory mode when
catalogs are stubs (exit 0), switches to enforcing mode once populated
(exit 1 on unknown fact_ids with file:line output).

- tooling/check-fact-ids: core validation script (<2s runtime)
- .config/hooks/pre-commit: hook dispatcher for modular checks
- Makefile: check-fact-ids + setup-hooks targets, wired into setup
- docs/DEVOPS.md: content validation and pre-commit hooks sections

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/DEVOPS.md

@@ -95,6 +95,40 @@ CI targets chain lint → build → test sequentially. A failure in any stage st
 make clean              # Remove build artifacts and .cache/ contents
 ```
 
+### Content Validation
+
+```bash
+make validate-content     # Validate content YAML against JSON schemas
+make check-fact-ids       # Check fact_id references against knowledge catalogs
+```
+
+`check-fact-ids` operates in two modes:
+- **Advisory** — when knowledge catalogs (`content/global/knowledge/*.yaml`) have no fact definitions yet: lists referenced fact_ids and exits cleanly.
+- **Enforcing** — when catalogs are populated: fails on any `fact_id` reference that doesn't match a canonical definition.
+
+## Pre-commit Hooks
+
+Git hooks are stored in `.config/hooks/` (version-controlled). Activate them with:
+
+```bash
+make setup          # Includes hook installation
+make setup-hooks    # Just hooks
+```
+
+Or manually:
+
+```bash
+git config core.hooksPath .config/hooks
+```
+
+Active checks:
+
+| Check | Script | Behavior |
+|-------|--------|----------|
+| fact_id validation | `tooling/check-fact-ids` | Warns if catalogs are stubs; fails on unknown fact_ids when populated |
+
+The `core.hooksPath` setting uses a relative path (`.config/hooks`) that resolves per worktree, so it works correctly across all worktrees in the repository.
+
 ## Configuration Files
 
 The `.config/` directory holds shared configuration for linters, formatters, and CI. Examples of what goes here: