chore(audit): refine docs-scripts detector and lock in via pre-commit

Two detector bugs fixed:

1. grep_includes missed *.lua, *.ini, *.desktop, *.json — so callers in
   elephant providers (lua), mako on-button-* hooks (ini), and any future
   MimeType-registered URL handlers (.desktop) were invisible. Adding them
   reclassifies nomarchy-notification-dismiss and nomarchy-theme-bg-set
   from `unused?` to `kept` (true callers in mako/core.ini and the
   elephant background_selector lua).

2. The all_refs regex `nomarchy-[a-z0-9][a-z0-9-]+` greedily captured
   trailing dashes, producing junk missing-tokens like `nomarchy-pkg-`,
   `nomarchy-cmd-`, `nomarchy-restart-`, etc. from glob references like
   `for c in nomarchy-pkg-*`. Tightened to require an alphanumeric end
   character. Also restricted to grep_includes so the binary tmpfile
   path `nomarchy-menu-rows` no longer leaks in.

New .githooks/pre-commit re-runs the generator and stages docs/SCRIPTS.md
whenever a nomarchy-* script changes. Enable per clone with
`git config core.hooksPath .githooks` (now mentioned in docs/AGENT.md).

Net audit shift after regen: unused? scripts 31→29, missing tokens 30→28,
no false-positive prefix tokens remain.

features/scripts/utils/nomarchy-docs-scripts

@@ -50,10 +50,13 @@ done
 # their own caller.)
 # File types we search for references. *.md catches docs and README;
 # branding/hook/extension files have varied or no extensions.
+# *.lua catches elephant providers; *.ini catches mako on-button-* hooks;
+# *.desktop catches MimeType-registered URL handlers.
 grep_includes=(
   --include='*.nix' --include='*.conf' --include='*.sh' --include='*.md'
-  --include='nomarchy-*' --include='*.jsonc' --include='*.toml'
-  --include='*.txt' --include='*.sample'
+  --include='nomarchy-*' --include='*.jsonc' --include='*.json'
+  --include='*.toml' --include='*.ini' --include='*.lua'
+  --include='*.desktop' --include='*.txt' --include='*.sample'
 )
 search_dirs=(core features themes installer hosts bin lib README.md)
 
@@ -75,7 +78,11 @@ ref_files_per_cmd() {
 }
 
 # All distinct nomarchy-* tokens we see anywhere in the repo.
-all_refs=$(grep -rohE 'nomarchy-[a-z0-9][a-z0-9-]+' \
+# Final char must be alphanumeric — dropping trailing-dash matches like
+# `nomarchy-pkg-` that come from glob references (`for c in nomarchy-pkg-*`).
+# Restrict to grep_includes so binaries / tmpfiles don't pollute the set.
+all_refs=$(grep -rohE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
+            "${grep_includes[@]}" \
             "${search_dirs[@]}" 2>/dev/null \
           | sort -u)