misc/git_hook: extract shared githook package; auto-rebuild on version bump (#19440)

Pull the hook logic into a reusable githook library package so
tailscale/corp can share it via a thin wrapper main instead of
keeping a forked copy in sync.

The install flow also changes: a wrapper scripts now build the
binary and reinstall the git hooks. Pulling new shared code no
longer requires re-running the installer.

Updates tailscale/corp#39860

Change-Id: I4d606d11c8c883015c190c54e3387a7f9fe4dd32

Signed-off-by: Fernando Serboncini <fserb@tailscale.com>

misc/git_hook/README.md

@@ -0,0 +1,34 @@
+# git_hook
+
+Tailscale's git hooks.
+
+The shared logic lives in the `githook/` package and is also imported by
+`tailscale/corp`.
+
+## Install
+
+From the repo root:
+
+    ./tool/go run ./misc/install-git-hooks.go
+
+The script auto-updates in the future.
+
+
+## Adding your own hooks
+
+Create an executable `.git/hooks/<hook-name>.local` to chain a custom
+script after a built-in hook. For example, put a custom check in
+`.git/hooks/pre-commit.local` and `chmod +x` it. The local hook runs
+only if the built-in hook succeeds; failure aborts the git operation.
+
+
+## Changing the shared code
+
+When you change anything under `githook/` or `launcher.sh`, bump
+`HOOK_VERSION` in the same commit so every dev auto rebuilds on their next
+git operation.
+
+Because `tailscale/corp` imports `githook/`, also plan the downstream
+update: after landing here, bump corp's `tailscale.com` dependency and
+bump corp's own `misc/git_hook/HOOK_VERSION` on a separate commit. Both are
+required.