Push in under 30 s: fast pre-push, full gauntlet once at merge, pass cache by tree hash #735

Operator goal (2026-10-27): every git push finishes in at most 30 s. Operator approved this design.

Why

• pre-push runs the whole gauntlet behind a machine-wide one-at-a-time queue. One PR ran it 3-5 times today (first push, each review-fix push, merge-pr.sh's sync push, a conflict fix), each several minutes plus queue time (one push waited 39 min behind a replay).
• A full-gauntlet push can never fit 30 s: tests/hooks/test-gates-irrecoverable-2.sh alone took 209 s and test-gates-other.sh 72 s (load 12-14).
• The safety that matters is in merge-pr.sh: the exact merged tree passes the full gauntlet before gh pr merge (feat(gauntlet): check the cost-ledger module stays a turn.complete observer (#443) #445/feat(mod): load marker and cached-vs-repo status (#442, #444) #446 were green alone, red together). That stays.

Design

1. git-hooks/pre-push keeps its cheap steps (ref parsing, the develop-push refusal, the develop-overlap check) and replaces the full gauntlet with a fast layer: lint of the files the push changes (bash -n, shellcheck, py/json lint, the home-path ban), no gauntlet queue, no test layer. Target well under 30 s. An env var (e.g. MH_PREPUSH_FULL=1) still runs the full gauntlet on demand.
2. scripts/merge-pr.sh runs the full gauntlet itself, on the exact tree it is about to push and merge, under the gauntlet lock, BEFORE pushing (today it relies on the pre-push hook for that). run_gauntlet_here likewise calls scripts/run-gauntlet.sh directly.
3. scripts/sync-pr-head.sh (the cloud path, whose pre-push is today the only gauntlet gate) runs the full gauntlet before its push.
4. Pass cache keyed by tree hash: scripts/run-gauntlet.sh records a pass under ~/.cache/mh/gauntlet-pass/<HEAD^{tree}> only after a full run where every layer passed and the working tree was clean (identical to HEAD). merge-pr.sh / sync-pr-head.sh skip the run on a hit. Never recorded on a partial, sharded, or dirty run.
5. Docs: CLAUDE.md validation block, docs/reference/repo-gotchas.md, docs/reference/branching-model.md, docs/reference/env-vars.md, the pre-push and run-gauntlet.sh headers.

Done when

• A push of a normal branch finishes in < 30 s on this machine (measured), and does not take the gauntlet lock.
• merge-pr.sh refuses to merge when the full gauntlet fails on the merged tree (test), and skips the run on a cached pass for the same tree (test).
• A dirty or partial run never writes a cache entry (test).

Related: #158 (timing rows flaky under load).