ci: run .claude/hooks/*.selftest.sh on every PR touching the hooks

[yinlianghui-tw]

Fixes #5754

What

Adds .github/workflows/hook-selftests.yml: a required check that runs
.claude/hooks/guard-main-checkout-bash.selftest.sh and
.claude/hooks/guard-shared-stash.selftest.sh on every PR (and push to main)
that touches .claude/hooks/** or the workflow file itself, and fails the
build the moment either self-test matrix reports a failing case. This is a
runner only — .claude/** (the hooks and their self-tests) is untouched, per
this card's ruling.

Measured before wiring anything (Zone 2)

On origin/main @ 53dc89db8, both self-tests were already green:

guard-main-checkout-bash.selftest.sh: 100 passed, 0 failed  — real 0m3.198s
guard-shared-stash.selftest.sh:        32 passed, 0 failed  — real 0m0.637s

Both need only jq and git (both preinstalled on ubuntu-latest) — no
install, no build. Runtime cost of the new job is therefore ~4s of self-test
execution plus a checkout.

Paired writes (PR #5984 shape)

• content/docs/guide/ci-cd-pipeline.md — workflow-inventory table row +
  a new ### Hook Self-Tests (hook-selftests.yml) section, plus the
  OPTIONAL_CONTEXTS enumeration in the Dependabot Auto-Merge prose.
• scripts/dependabot-merge-gate.mjs — classifies the new Hook
  Self-Tests check as OPTIONAL_CONTEXTS (path-filtered like Changeset Bump Policy / Bundle Analysis: present → must be success; absent → a
  Dependabot bump never touches .claude/hooks/**, so it is never waited
  for).

scripts/__tests__/ci-cd-pipeline-doc.test.ts and
scripts/__tests__/dependabot-merge-gate.test.ts went red before these two
writes (undocumented workflow / unclassified produced check) and pass now —
that is them working correctly.

Why path-filtered, unlike control-bytes.yml

control-bytes.yml carries no paths filter because a raw control byte can
land in a markdown-only PR as easily as a TypeScript one. That does not
transfer here: both self-tests assert the current hook script's behaviour
against a fixture they build themselves — nothing about a docs-only PR can
move the result. So this workflow mirrors changeset-guard.yml's
path-filtered shape instead (see the workflow's own header for the full
reasoning and cost note).

Tests

• pnpm exec vitest run scripts/__tests__/ci-cd-pipeline-doc.test.ts scripts/__tests__/dependabot-merge-gate.test.ts — 2 files, 67 tests, all
  passed.
• pnpm exec vitest run scripts/__tests__/ (full suite) — 64 files, 1703
  tests, all passed.
• pnpm lint — see report comment for the verdict captured at head SHA.
• node scripts/check-changeset-presence.mjs — no changeset owed (CI-only
  change, no released package's src/ changed); an empty-frontmatter
  changeset was added anyway, matching this repo's convention (no
  skip-changeset label exists here — objectui#4912 / .github/WORKFLOWS.md documents 5 workflows that do not exist and omits 9 that do — including a changeset gate and a skip-changeset label neither of which is real #3724).

---

Generated by Claude Code