ci: sync canonical pre-commit config

[xnoto]

Summary

• generate and ignore the canonical pre-commit config instead of tracking a stale copy
• refresh it atomically on every make test
• install pre-commit and commit-msg hooks
• add narrow Gitleaks allowlists for generated OpenTofu data and public token IDs

Validation

• make test
• canonical pre-commit run --all-files

[github-actions]

OpenTofu Plan

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and