Add pre-push hook for npm ci validation

Catches lock file drift locally before it breaks CI. Includes
install instructions in git-workflow.md.

README.md

@@ -14,6 +14,7 @@ Engineering conventions and best practices for Sea Haven Industries.
 - [SAM Project Layout](sam-project-layout.md) -- standard directory structure for serverless projects
 - [Secrets and Configuration](secrets-and-config.md) -- Secrets Manager vs SSM Parameter Store
 - [CI/CD Pipelines](cicd.md) -- every deployable repo gets a pipeline, no manual deploys
+- [Git Hooks](hooks/) -- recommended pre-push and pre-commit hooks
 
 ## Contributing
 

git-workflow.md

@@ -73,6 +73,21 @@ git push origin v1.2.0
 
 Start at `v0.1.0` for new projects. Move to `v1.0.0` when the interface is stable and has external consumers.
 
+## Git Hooks
+
+Recommended hooks live in [`hooks/`](hooks/) — copy them into `.git/hooks/` when setting up a project.
+
+| Hook | Purpose |
+|---|---|
+| `pre-push` | Runs `npm ci` to catch lock file drift before it breaks CI |
+
+Install for a Node.js project:
+
+```bash
+cp ~/Documents/repositories/engineering-handbook/hooks/pre-push .git/hooks/pre-push
+chmod +x .git/hooks/pre-push
+```
+
 ## Cleaning Up
 
 After a PR is merged:

hooks/pre-push

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Pre-push hook: verify npm ci passes before pushing Node.js projects.
+# Catches lock file drift that would break CI.
+#
+# Install: cp hooks/pre-push .git/hooks/pre-push && chmod +x .git/hooks/pre-push
+
+set -euo pipefail
+
+if [[ ! -f package-lock.json ]]; then
+  exit 0
+fi
+
+echo "pre-push: running npm ci..."
+if ! npm ci --ignore-scripts --no-audit --no-fund 2>/dev/null; then
+  echo "pre-push: npm ci failed — lock file may be out of sync."
+  echo "Run: rm -rf node_modules package-lock.json && npm install"
+  exit 1
+fi
+echo "pre-push: npm ci passed."