feat(cli): opt-in pre-push reminder for unconsolidated staging

[mashware]

What

Closes the gap where findings staged during a session never get consolidated because the push happened outside the agent (so the agent's PR-time consolidation flow never ran).

• domain-memory staging-status [--branch name] [--json] [--quiet] — read-only count of unconsolidated findings on a branch. Never opens the SQLite index, always exits 0. The engine behind the hook.
• Opt-in pre-push hook — install --git-hook writes a non-blocking .git/hooks/pre-push that prints a one-line nudge when the branch you push still has staged findings. Plain install prompts before touching .git/hooks.

Design decisions

• Warns, never blocks — a blocked push over "you forgot to document" would violate the project's principle feat(cli): opt-in pre-push reminder for unconsolidated staging #3 (silent failures / stay out of the way). And push ≠ merge, so the reminder still arrives in time.
• Opt-in — .git/hooks is per-clone and may conflict with husky / core.hooksPath, so installing is gated behind a prompt (or --git-hook for non-interactive).
• Idempotent + chaining — re-running keeps a single block; a foreign pre-push hook is appended to, never clobbered.
• Graceful degradation — no-op if the domain-memory CLI is not on PATH (npx-only users).
• Scope — staging reminder only this iteration; check-drift in the hook is left for a follow-up.

Tests

• staging-status.test.ts — count per branch, branch isolation, no-branch resolution, always-exit-0, JSON output.
• writers.test.ts — writeGitHook skip-no-git, creates executable hook, idempotency, chaining onto a foreign hook.
• Verified end-to-end: install --git-hook writes an executable hook, a real git push fires the reminder and is not blocked.

All workspaces: typecheck clean, tests green (CLI 70, server 83, web 22).