chore: adopt make pre-commit workflow with full pre-commit hook suite

[Lang-Akshay]

Summary

Adopts the make pre-commit workflow for the data-plane repo, mirroring the ContextForge control-plane pre-commit setup.

Changes

• .pre-commit-config.yaml — full hook suite: private key detection, large-file guard, merge-conflict check, end-of-file / trailing-whitespace / encoding fixers, BiDi control forbid, AI-slop guards, IBM detect-secrets, and Rust hooks (cargo fmt, clippy, deny, nextest, build, bench). All revs pinned to commit SHAs. End-of-file fixer excludes .gitignore (intentionally no trailing newline).
• Makefile — make pre-commit target: runs the full suite hermetically with PRE_COMMIT_HOME and TMPDIR redirected under .cache/ (nothing written to ~).
• .secrets.baseline — generated baseline for IBM detect-secrets covering dev TLS/JWT keys in assets/, test fixture secrets, and scanner test-vector strings inside cpex-secrets-detection.
• scripts/git/resolve-secrets-baseline-conflict.sh — helper to resolve merge conflicts in .secrets.baseline by re-scanning.
• .gitignore — adds .cache/ (pre-commit home, venvs, tmp).
• .gitattributes — marks generated/binary files for diff hygiene.

Acceptance

• make pre-commit runs the full suite against all files and passes on a clean tree.
• All hook revs pinned to SHAs.
• Caches land under .cache/ — nothing written to ~.
• Re-running is idempotent; formatter changes require re-staging.

Closes IBM/mcp-context-forge#5960