fix: Makefile target hooks makes precommit work finally

Makefile

@@ -23,9 +23,12 @@ help: ## Show this help
 	grep -E '^[a-zA-Z0-9_-]+:.*?## ' $(MAKEFILE_LIST) | sort | sed 's/:.*##/: /'
 
 # ---- Git hooks ----
-hooks: ## Configure git to use repo-local hooks (.githooks)
+hooks: ## Configure git to use repo-local hooks (.githooks) and ensure executables
+	@mkdir -p .githooks
 	git config core.hooksPath .githooks
-	@echo "✔ hooks enabled (core.hooksPath=.githooks)"
+	@test -f .githooks/pre-commit || (echo "❌ Missing .githooks/pre-commit"; exit 1)
+	chmod +x .githooks/pre-commit
+	@echo "✔ hooks enabled and pre-commit is executable"
 
 hooks-test: ## Test secrets hook blocks plaintext in secrets/
 	@mkdir -p secrets && echo 'PLAINTEXT_TEST=true' > secrets/_hook_test.yaml

secrets/example.enc.txt

@@ -1,15 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:KgBAa9cBWuARxDsXHu/2O86F2g==,iv:XUQZUlVFEO7JHgD7v6uVfB+T18vk82k/aCHZ62HTclE=,tag:2aEUnU16YUCfy1pUxumLVw==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWSnpvZzhTNnZqOENkOVp2\nbG5QbUYvckdjYXFlaXFpbjBGcjNUeW9PRjNZCmkrQjFJdlNKdE1GQWNlSHhYYjd6\nZVQ4M2hRelI2R1dyZnE2dlBRRkcyVjAKLS0tIDRSdmQ4QWt6dlE2bTJHMDlQYS9n\ndCtqMUV2RWJCTmhFaXJkSndnU0FGR3MK4vuIpBDg8LiTEsWC8GpAYYNeNpih+3DC\nPHqb6jZwngIoxm1BI/Bpd3HwaFeznueSQFy4THsV4N8baKqdDj01YQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-09-13T20:16:58Z",
-		"mac": "ENC[AES256_GCM,data:09hU95lN4ZCiR6Ag/7Ref/cSfEzLDuEk9OKGQVG9V+rnkSkxlJnOBmAxixP96C7HNIPnamo48oOFzSam107ulzG9aQCfUV4QsT3LtFEBLkrU6r259A/i6/INxAERASGl91MLiO6JhfKoHTlZWx17Vb57Pg2rTef6eBrz708Y4Pc=,iv:9yToNT/XYjlytts9YJM6uASQNBruXc5H1Wqtn9oES7E=,tag:TgD0DN8kQggcmP4S11bXFw==,type:str]",
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.10.2"
-	}
-}

secrets/example.txt

@@ -1 +0,0 @@
-This is as secret!

secrets/test.txt

@@ -1 +0,0 @@
-This should not commit!

secrets/testagain.txt

@@ -1 +0,0 @@
-Another don't accept plaintext in secrets test!