fix: Makefile target hooks makes precommit work finally

Makefile

@@ -23,9 +23,12 @@ help: ## Show this help
 	grep -E '^[a-zA-Z0-9_-]+:.*?## ' $(MAKEFILE_LIST) | sort | sed 's/:.*##/: /'
 
 # ---- Git hooks ----
-hooks: ## Configure git to use repo-local hooks (.githooks)
+hooks: ## Configure git to use repo-local hooks (.githooks) and ensure executables
+	@mkdir -p .githooks
 	git config core.hooksPath .githooks
-	@echo "✔ hooks enabled (core.hooksPath=.githooks)"
+	@test -f .githooks/pre-commit || (echo "❌ Missing .githooks/pre-commit"; exit 1)
+	chmod +x .githooks/pre-commit
+	@echo "✔ hooks enabled and pre-commit is executable"
 
 hooks-test: ## Test secrets hook blocks plaintext in secrets/
 	@mkdir -p secrets && echo 'PLAINTEXT_TEST=true' > secrets/_hook_test.yaml