fix: add lefthook pre-commit check for binary artifacts

Mirrors the CI workflow check locally — catches binary extensions,
build directories, dSYM directories, and files over 1 MB at commit
time instead of waiting for CI.

lefthook.yml

@@ -11,6 +11,43 @@ output:
 pre-commit:
   parallel: true
   commands:
+    check-binaries:
+      tags: binaries
+      run: |
+        VIOLATIONS=0
+        STAGED=$(git diff --cached --name-only --diff-filter=ACM)
+        [ -z "$STAGED" ] && exit 0
+
+        BINARIES=$(echo "$STAGED" | grep -iE '\.(exe|dll|so|dylib|o|obj|a|lib|wasm)$' || true)
+        if [ -n "$BINARIES" ]; then
+          echo "Binary files detected:" && echo "$BINARIES"
+          VIOLATIONS=1
+        fi
+
+        BUILD=$(echo "$STAGED" | grep -E '/build/' || true)
+        if [ -n "$BUILD" ]; then
+          echo "Files in build directories:" && echo "$BUILD"
+          VIOLATIONS=1
+        fi
+
+        DSYM=$(echo "$STAGED" | grep -E '\.dSYM/' || true)
+        if [ -n "$DSYM" ]; then
+          echo "dSYM directories:" && echo "$DSYM"
+          VIOLATIONS=1
+        fi
+
+        for f in $STAGED; do
+          [ ! -f "$f" ] && continue
+          case "$f" in pnpm-lock.yaml|*/package-lock.json) continue ;; esac
+          SIZE=$(wc -c < "$f" | tr -d ' ')
+          if [ "$SIZE" -gt 1048576 ]; then
+            echo "Oversized file: $f ($((SIZE / 1024)) KB)"
+            VIOLATIONS=1
+          fi
+        done
+
+        [ "$VIOLATIONS" -eq 1 ] && exit 1
+        exit 0
     sync-lockfile:
       tags: lockfile
       glob: "**/package.json"