bin: pre-push hook to catch stale Cargo.lock

[jasonhernandez]

Summary

• Adds bin/git-hook-pre-push that fails fast (~0.5s) with cargo metadata --locked --offline when pushed commits leave Cargo.lock out of sync with Cargo.toml.
• Only runs when the push actually touches Cargo.toml or Cargo.lock, so non-Rust pushes are unaffected.
• Documents the one-line install in CLAUDE.md under the existing Cargo.lock section.

Motivated by #35704, where a missing Cargo.lock line sunk both lint-and-rustfmt (check-no-diff.sh) and lint-dependencies (cargo tree --locked refuses to run against a stale lock). This hook would have caught it before the 15-minute CI round-trip.

Install is opt-in per clone:

ln -sf ../../bin/git-hook-pre-push .git/hooks/pre-push

Bypass with git push --no-verify if ever needed.

Test plan

• Verified hook exits 0 on a clean push (no Cargo changes, or Cargo changes with fresh lockfile).
• Verified hook exits 1 with the actionable message against the exact state from authenticator: zeroize ValidatedClaims and OidcClaims on drop #35704 (Cargo.toml added zeroize without updated Cargo.lock).
• Draft pending team review of the approach before flipping to ready.

🤖 Generated with Claude Code