chore(audit): refine docs-scripts detector and lock in via pre-commit

Two detector bugs fixed:

1. grep_includes missed *.lua, *.ini, *.desktop, *.json — so callers in
   elephant providers (lua), mako on-button-* hooks (ini), and any future
   MimeType-registered URL handlers (.desktop) were invisible. Adding them
   reclassifies nomarchy-notification-dismiss and nomarchy-theme-bg-set
   from `unused?` to `kept` (true callers in mako/core.ini and the
   elephant background_selector lua).

2. The all_refs regex `nomarchy-[a-z0-9][a-z0-9-]+` greedily captured
   trailing dashes, producing junk missing-tokens like `nomarchy-pkg-`,
   `nomarchy-cmd-`, `nomarchy-restart-`, etc. from glob references like
   `for c in nomarchy-pkg-*`. Tightened to require an alphanumeric end
   character. Also restricted to grep_includes so the binary tmpfile
   path `nomarchy-menu-rows` no longer leaks in.

New .githooks/pre-commit re-runs the generator and stages docs/SCRIPTS.md
whenever a nomarchy-* script changes. Enable per clone with
`git config core.hooksPath .githooks` (now mentioned in docs/AGENT.md).

Net audit shift after regen: unused? scripts 31→29, missing tokens 30→28,
no false-positive prefix tokens remain.

.githooks/pre-commit

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Nomarchy pre-commit hook.
+#
+# Enable per-clone with:
+#   git config core.hooksPath .githooks
+#
+# Re-runs the script audit generator when any nomarchy-* script in the three
+# script directories is added, modified, or deleted in this commit, then
+# stages the refreshed docs/SCRIPTS.md so it lands together with the change.
+
+set -e
+
+repo_root="$(git rev-parse --show-toplevel)"
+cd "$repo_root"
+
+script_dirs_re='^(features/scripts/utils|core/system/scripts|themes/engine/scripts)/nomarchy-'
+
+if git diff --cached --name-only --diff-filter=ACMRD | grep -qE "$script_dirs_re"; then
+  echo "pre-commit: regenerating docs/SCRIPTS.md (script change detected)…"
+  ./bin/utils/nomarchy-docs-scripts --out docs/SCRIPTS.md
+  git add docs/SCRIPTS.md
+fi