build(lefthook): wire 4 brain controllers — C1/C2/C3/C4 (Task C5)

pre-commit jobs 11-13:
- l1-watcher (WARN-only via || true; glob settings.json + Tooling)
- cross-ref-checker (WARN-only via || true; glob 5 normative files)
- observer-of-observer (always exit 0 by design)

post-commit job 14:
- status-md (regenerates docs/observer/STATUS.md + stages it for
  next commit; never fails commit via || true)

Both l1-watcher and cross-ref-checker are WARN-only initially because:
- l1-watcher surfaces 9 known pre-existing 'name@source' drifts
  (see commit 4382de3); strict mode pending alias resolution.
- cross-ref-checker surfaces noise from historical «наследие» entries
  in headers (see commit a780959 DWC); strict mode pending refinement.

observer-of-observer is warn-only by spec (no fail until C3 prune
threshold 54 weeks).

Verified via npx lefthook run pre-commit on staged lefthook.yml —
all 14 jobs evaluate cleanly: 9 skipped (glob mismatch), 5 ran
(including new observer-of-observer warn).

Per ADR-011 + plan Task C5.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lefthook.yml

@@ -150,6 +150,53 @@ pre-commit:
         Если это осознанное архитектурное изменение — сначала обнови
         app/deptrac.yaml (и при необходимости ADR-005), затем коммить.
 
+    # 11. l1-watcher — детектор settings.json ↔ Tooling Прил. Н drift
+    # (brain governance C1, ADR-011 spec §6.1). WARN-mode (|| true): 9 pre-existing
+    # drifts (frontend-design@claude-plugins-official + 8 ToB plugins) — известный
+    # naming-vocabulary mismatch (settings.json machine name vs Tooling human name).
+    # Strict mode после добавления tools/.l1-watcher-aliases.txt — follow-up.
+    - name: l1-watcher
+      glob: "{.claude/settings.json,docs/Tooling_v8_3.md}"
+      run: node tools/l1-watcher.mjs || true
+      fail_text: |
+        l1-watcher detected settings.json ↔ Tooling Прил. Н drift.
+        Run /claude-md-management:claude-md-improver to formalize plugin.
+        (Currently WARN-only per follow-up alias work.)
+
+    # 12. cross-ref-checker — version drift между нормативными файлами
+    # (brain governance C2, ADR-011 spec §6.2). WARN-mode (|| true): real-world
+    # surfaces noise от исторических «наследие» entries в headers нормативки —
+    # refinement (scope to §0 cross-refs marker) — follow-up.
+    - name: cross-ref-checker
+      glob: "{docs/Pravila_raboty_Claude_v1_1.md,docs/Tooling_v8_3.md,docs/Plugin_stack_rules_v1.md,CLAUDE.md,MEMORY.md}"
+      run: node tools/cross-ref-checker.mjs || true
+      fail_text: |
+        cross-ref-checker detected version drift in §0 cross-refs.
+        Update offending file.
+        (Currently WARN-only per follow-up refinement.)
+
+    # 13. observer-of-observer — счётчик чтений docs/observer/ + 54-week self-prune
+    # (brain governance C3, ADR-011 spec §6.3). Скрипт всегда exit 0 (warn-only by
+    # design). При observer infrastructure не используется >=54 недель — warn.
+    - name: observer-of-observer
+      run: node tools/observer-of-observer.mjs check
+      fail_text: |
+        observer-of-observer reports stale state.
+        Consider running /brain-retro or archiving docs/observer/.
+
+# Post-commit: regenerate STATUS.md dashboard (informational, not gate)
+post-commit:
+  parallel: false
+  jobs:
+    # 14. status-md generator — brain governance C4, ADR-011 spec §6.4. Rebuilds
+    # docs/observer/STATUS.md after each commit. Pure JS +execFileSync — Security
+    # Guidance #40 compliant. STATUS.md becomes staged for NEXT commit — owner
+    # reviews before persisting.
+    - name: status-md
+      run: node tools/status-md-generator.mjs && git add docs/observer/STATUS.md || true
+      fail_text: |
+        status-md regeneration failed.
+
 # Pre-push: проверки перед git push (медленнее, но реже запускаются)
 pre-push:
   parallel: false