fix: repair test regressions and add pre-commit/pre-push verification gates

Fix four pre-existing bugs exposed after resolving a build failure:
- sandboxCloneSource: accept any URL scheme for origin remote (was filtering out https://)
- setupSandbox callers: fix := shadow variable so sandboxDir is set on BlockedError
- parseGeminiStream: parse result lines to return execution errors and cost
- TestElaborateTask_InvalidJSONFromClaude: stub Gemini fallback so test is hermetic

Add verification infrastructure:
- scripts/verify: runs go build + go test -race, used by hooks and deploy
- scripts/hooks/pre-commit: blocks commits that don't compile
- scripts/hooks/pre-push: blocks pushes where tests fail
- scripts/install-hooks: symlinks version-controlled hooks into .git/hooks/
- scripts/deploy: runs scripts/verify before building the binary

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 23 insertions, 0 deletions

diff --git a/scripts/install-hooks b/scripts/install-hooks
new file mode 100644
index 0000000..454f3cd
--- /dev/null
+++ b/scripts/install-hooks
@@ -0,0 +1,23 @@
+#!/bin/bash
+# install-hooks — Symlink version-controlled hooks into .git/hooks/
+# Usage: ./scripts/install-hooks
+# Example: ./scripts/install-hooks
+
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+HOOKS_SRC="${REPO_DIR}/scripts/hooks"
+HOOKS_DST="${REPO_DIR}/.git/hooks"
+
+for hook in "${HOOKS_SRC}"/*; do
+    name="$(basename "${hook}")"
+    target="${HOOKS_DST}/${name}"
+    if [ -e "${target}" ] && [ ! -L "${target}" ]; then
+        echo "  skipping ${name}: non-symlink already exists at ${target}"
+        continue
+    fi
+    ln -sf "${hook}" "${target}"
+    echo "  installed ${name}"
+done
+
+echo "==> Hooks installed."