chore: tighten local-path-leak guard scope and tooling

- Narrow the worktree-id/T3-path check to docs/superpowers/specs and
  docs/superpowers/plans. Scanning the whole repo flagged any
  legitimate reference to .t3/worktrees or t3code-<hex> (fixtures,
  example configs) and would block unrelated commits.
- Switch the pre-commit hook shebang to bash and call the check via
  an absolute path derived from git rev-parse so the hook works
  regardless of the cwd git happens to invoke it from.
- install-hooks now warns when it overwrites an existing
  core.hooksPath rather than silently clobbering a custom setup.
- Add make verify-local-paths to the AGENTS.md pre-MR checklist so
  contributors run it explicitly even when --no-verify is used.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.githooks/pre-commit

@@ -1,4 +1,6 @@
-#!/usr/bin/env sh
-set -eu
+#!/usr/bin/env bash
+set -euo pipefail
 
-scripts/check-local-path-leaks.sh --cached
+# Resolve via git toplevel so the hook works from any cwd (e.g., when
+# git invokes hooks from within a non-root subdirectory).
+"$(git rev-parse --show-toplevel)/scripts/check-local-path-leaks.sh" --cached

AGENTS.md

@@ -58,6 +58,7 @@ Run before opening a merge request:
 
 - `cd web && pnpm run lint`
 - `cd web && pnpm run format:check`
+- `make verify-local-paths`
 
 For local services, start PostgreSQL and Redis with `docker compose up -d postgres redis`.
 

Makefile

@@ -49,6 +49,10 @@ verify-local-paths:
 
 # Install repo-local git hooks for this checkout/worktree.
 install-hooks:
+	@existing="$$(git config --local core.hooksPath 2>/dev/null || true)"; \
+	if [ -n "$$existing" ] && [ "$$existing" != ".githooks" ]; then \
+		echo "warning: overwriting existing local core.hooksPath ($$existing) with .githooks"; \
+	fi
 	git config core.hooksPath .githooks
 
 # Fetch and build the pinned Jellyfin Web bundle

scripts/check-local-path-leaks.sh

@@ -51,7 +51,7 @@ check_pattern() {
 check_pattern \
 	"T3 worktree path or generated worktree id" \
 	"(${t3_worktree_dir}|/Users/[^[:space:]]*/${t3_worktree_dir}/|${t3_worktree_id_prefix}[0-9a-f]{8})" \
-	.
+	docs/superpowers/specs docs/superpowers/plans
 
 check_pattern \
 	"absolute local filesystem path in generated superpowers docs" \