S0.3: just verify + pre-push hook gates the smoke chain

Sprint 0 / R-004 / GATE-0.4 — the 9-smoke chain is no longer
documentation only. One command (`just verify`) runs vet + tests +
all 9 smokes; pre-push hook calls it; a regression cannot leave
this machine without explicit --no-verify override.

Recipes:
  just verify          full gate (33s wall on this box)
  just smoke <day>     single smoke (d1..d6, g1, g1p, g2)
  just smoke-all       all 9 smokes only
  just doctor          dep probe with structured output
                       (--json for CI / pre-push)
  just install-hooks   install .git/hooks/pre-push
  just fmt|vet|test|build|clean

scripts/doctor.sh probes Go ≥1.25, gcc, MinIO at :9000 with bucket
lakehouse-go-primary, Ollama at :11434 with nomic-embed-text loaded,
/etc/lakehouse/secrets-go.toml with [s3.primary]. Each missing dep
prints its install fix command. JSON mode emits the same shape for
CI / pre-push consumers.

README updated with the task-runner section + just install-hooks
on cold-start. Hooks live in .git/hooks/ (untracked); install
recipe recreates them on a fresh clone.

PATH note: justfile prepends /usr/local/go/bin so recipes find Go
without depending on the parent shell's PATH (ADR-001 §1.x lives
go there).

Verified: just verify exits 0 in 33s wall (vet ~0.1s + test ~0.1s +
9 smokes deterministic per audit baseline). Pre-push hook installed
and bash -n clean.

Closes audit risk R-004 (smokes not gated).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -53,20 +53,38 @@ scripts/g1p_smoke.sh  # vectord state survives kill+restart via storaged
 scripts/g2_smoke.sh   # embed → vectord add → search round-trip
 ```
 
-Run them all in any order:
+Or run the full gate via the task runner (see below):
 ```
-for s in scripts/{d1,d2,d3,d4,d5,d6,g1,g1p,g2}_smoke.sh; do "$s" || break; done
+just verify     # vet + tests + 9 smokes; ~33s wall
 ```
 
+## Task runner
+
+```
+just                 # show available recipes
+just verify          # full Sprint 0 gate (vet + tests + 9 smokes)
+just smoke <day>     # single smoke (d1..d6, g1, g1p, g2)
+just doctor          # check cold-start deps; --json for CI
+just install-hooks   # install pre-push hook that runs just verify
+```
+
+After a fresh clone, run `just install-hooks` once so `git push` is
+gated on the same green chain that ran here. Hook lives in
+`.git/hooks/pre-push` (not tracked; recreated by the recipe).
+
 ## Cold-start dependencies
 
 - Go 1.25+ at `/usr/local/go/bin` (arrow-go pulled the 1.25 floor)
 - `gcc` + `libc-dev` for the DuckDB cgo binding (ADR-001 §1.1)
+- `just` task runner (`apt install just` on Debian 13+)
 - MinIO running on `:9000` with bucket `lakehouse-go-primary`
 - Ollama running on `:11434` with `nomic-embed-text` loaded (G2)
 - `/etc/lakehouse/secrets-go.toml` with `[s3.primary]` credentials
   (storaged + queryd both read this)
 
+`just doctor` probes all of the above and reports the fix command
+for each missing dep. CI / scripts can use `just doctor --json`.
+
 ## Layout
 
 ```