pre-push Lens pass + make hooks installer

.githooks/pre-push runs 'make verify', tees the log to .git/lens-pass.log and,
on failure, prints one summary (last step started, log path, bypass) before
exiting 1. 'make hooks' symlinks .githooks/* into the clone's hooks dir.

core.hooksPath is deliberately left alone: bd keeps its own pre-commit
(post-merge) hooks in .git/hooks and pointing hooksPath at .githooks would
silently retire them while bd still reports them installed.

Makefile

@@ -2,7 +2,7 @@
 
 MISE_BIN ?= mise
 
-.PHONY: check precommit deps compile test test-elisp format verify
+.PHONY: check precommit verify hooks deps compile test test-elisp format
 
 # Cheap static gate over both apps, cheapest first. No database, no coverage:
 # this is the loop you run freely while working and before every commit.
@@ -27,6 +27,23 @@ verify: check
 	@echo "==> verify: blogex"
 	@$(MAKE) -C blogex MISE_BIN=$(MISE_BIN) verify
 
+# Install the versioned hooks in .githooks/ into this clone's hooks directory as
+# symlinks (edits take effect immediately, no copy to drift). Idempotent; re-run
+# after moving the clone, since the links are absolute.
+#
+# core.hooksPath is deliberately NOT changed: bd manages its own hooks inside
+# .git/hooks (pre-commit flushes .beads/issues.jsonl, post-merge imports it) and
+# moving the hooks path would silently retire them.
+hooks:
+	@hooks_dir=$$(git rev-parse --git-path hooks); \
+	root=$$(git rev-parse --show-toplevel); \
+	mkdir -p "$$hooks_dir"; \
+	for hook in .githooks/*; do \
+		name=$$(basename "$$hook"); \
+		ln -sfn "$$root/$$hook" "$$hooks_dir/$$name"; \
+		echo "installed $$hooks_dir/$$name -> $$hook"; \
+	done
+
 # Sync dependencies
 deps:
 	@make -C app deps