feat: add git-hooks.nix pre-commit checks to flake

Add cachix/git-hooks.nix input and wire basedpyright, ruff,
ruff-format, and commitizen hooks into flake checks and devShell.
The basedpyright hook runs against a Nix-built venv so imports
resolve correctly in the sandbox.

flake.nix

@@ -21,6 +21,11 @@
       inputs.uv2nix.follows = "uv2nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    git-hooks = {
+      url = "github:cachix/git-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -30,6 +35,7 @@
       pyproject-nix,
       uv2nix,
       pyproject-build-systems,
+      git-hooks,
       ...
     }:
     let
@@ -97,6 +103,35 @@
         )
       );
 
+      mkGitHooksCheck =
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          pythonSet = pythonSets.${system};
+          venv = pythonSet.mkVirtualEnv "bulkgen-check-env" workspace.deps.default;
+        in
+        git-hooks.lib.${system}.run {
+          src = ./.;
+          hooks = {
+            basedpyright = {
+              enable = true;
+              entry = "${pkgs.basedpyright}/bin/basedpyright --pythonpath ${venv}/bin/python --project ${
+                pkgs.writeText "pyrightconfig.json" (
+                  builtins.toJSON {
+                    reportMissingTypeStubs = false;
+                    reportUnnecessaryTypeIgnoreComment = false;
+                  }
+                )
+              }";
+              files = "\\.py$";
+              types = [ "file" ];
+            };
+            ruff.enable = true;
+            ruff-format.enable = true;
+            commitizen.enable = true;
+          };
+        };
+
     in
     {
       packages = forAllSystems (
@@ -127,6 +162,7 @@
         in
         {
           inherit (pythonSet.bulkgen.passthru.tests) pytest;
+          pre-commit = mkGitHooksCheck system;
         }
       );
 
@@ -151,6 +187,7 @@
             shellHook = ''
               unset PYTHONPATH
               export REPO_ROOT=$(git rev-parse --show-toplevel)
+              ${(mkGitHooksCheck system).shellHook}
             '';
           };
         }