chore(ci): add pre-push typecheck gate and runner-crash retry

[simonhagger]

Summary

• New .husky/pre-push\ hook runs \pnpm typecheck\ (
  x run-many -t build --all) — the exact command behind the CI \ ypecheck\ quality gate — so divergences surface on the developer machine before the remote ever sees them
• CI \ ypecheck\ job now retries once, only when the nx process is killed by a runner-level crash (SIGSEGV / 'Command was killed'), as observed in run 32710783857; genuine type errors still fail fast without retry

Validation

• \pnpm typecheck\ green locally across all 12 projects
• Push of this very branch executed the new pre-push hook end-to-end (gate ran, then remote accepted)

Security Checklist

• Security review completed
• Threat model updated or N/A explained
• Confirmed no secrets/sensitive data present in committed files