Add cachix/git-hooks.nix input and wire basedpyright, ruff, ruff-format, and commitizen hooks into flake checks and devShell. The basedpyright hook runs against a Nix-built venv so imports resolve correctly in the sandbox.