feat(docs): complete P2.6 type safety cleanup and P2.7 system invariants

P2.6: Type Safety Cleanup
- Replaced 'any' return types in vite-plugin.ts with concrete types (UserConfig, transform return type)
- Documented TypeScript mixin 'any[]' exception in PlatformServiceMixin.ts
- Audit confirmed: zero 'any' in codebase except documented TS mixin limitation
- All external boundaries use 'unknown', all data payloads use 'Record<string, unknown>'

P2.7: System Invariants Documentation
- Created SYSTEM_INVARIANTS.md documenting all 6 enforced invariants
- Added to docs/00-INDEX.md under Policy & Contracts section
- Each invariant includes: What, Why, How, Where

Progress Docs Updates:
- Updated 00-STATUS.md: marked P2.6/P2.7 complete, added type safety invariant note
- Updated 01-CHANGELOG-WORK.md: added 2025-12-22 entries for P2.6/P2.7
- Updated 03-TEST-RUNS.md: added P2.6 type safety audit test run
- Updated P2-DESIGN.md: marked P2.6 acceptance criteria complete
- Updated SYSTEM_INVARIANTS.md: added Type Safety Notes section

Baseline Tag:
- Created v1.0.11-p0-p1.4-p1.5-p2.6-p2.7-complete

TypeScript compilation: ✅ PASSES
Build: ✅ PASSES
CI: ✅ All checks pass

githooks/pre-push

@@ -0,0 +1,38 @@
+#!/bin/bash
+#
+# Pre-push Git Hook
+#
+# Runs local CI before allowing push to remote.
+# This ensures code quality and packaging safety before sharing changes.
+#
+# Setup:
+#   git config core.hooksPath githooks
+#
+# To skip (not recommended):
+#   git push --no-verify
+#
+
+set -euo pipefail
+
+# Get project root
+PROJECT_ROOT="$(git rev-parse --show-toplevel)"
+cd "$PROJECT_ROOT"
+
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "Pre-push: Running local CI..."
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+
+# Run local CI
+if ./ci/run.sh; then
+    echo ""
+    echo "✅ Pre-push check passed - proceeding with push"
+    exit 0
+else
+    echo ""
+    echo "❌ Pre-push check failed - push blocked"
+    echo ""
+    echo "To skip this check (not recommended): git push --no-verify"
+    exit 1
+fi
+