chore(vault): rebuild git infra (gitignore/attributes/mailmap/hooks)

.githooks/pre-commit

@@ -1,11 +1,40 @@
 #!/bin/sh
-# pre-commit — 验证被修改的 wiki 页面 frontmatter
-CHANGED=$(git diff --cached --name-only --diff-filter=ACM | grep '^wiki/.*\.md$')
-if [ -z "$CHANGED" ]; then exit 0; fi
+# pre-commit — frontmatter validation + large file guard + secret scan
 
-python tools/scripts/validate-frontmatter.py --git-hook
-if [ $? -ne 0 ]; then
-    echo "ERROR: Frontmatter validation failed. Commit rejected."
-    echo "Run 'python tools/scripts/validate-frontmatter.py --files <file>' to check."
+# 1. Frontmatter validation for wiki pages
+CHANGED=$(git diff --cached --name-only --diff-filter=ACM | grep '^wiki/.*\.md$')
+if [ -n "$CHANGED" ]; then
+    python tools/scripts/validate-frontmatter.py --git-hook
+    if [ $? -ne 0 ]; then
+        echo "ERROR: Frontmatter validation failed. Commit rejected."
+        echo "Run 'python tools/scripts/validate-frontmatter.py --files <file>' to check."
+        exit 1
+    fi
+fi
+
+# 2. Large file guard (>10MB) — prevent accidental PDF/video/attachment commits
+MAX_SIZE=10485760  # 10 MB
+REJECT=""
+for f in $(git diff --cached --name-only --diff-filter=ACM); do
+    [ -f "$f" ] || continue
+    FSIZE=$(wc -c < "$f" 2>/dev/null | tr -d ' ')
+    [ -z "$FSIZE" ] && FSIZE=0
+    if [ "$FSIZE" -gt "$MAX_SIZE" ]; then
+        REJECT="$REJECT
+  $f ($FSIZE bytes)"
+    fi
+done
+if [ -n "$REJECT" ]; then
+    echo "ERROR: Files exceed 10MB limit (rejected):$REJECT"
+    echo "Use Git LFS or add to .gitignore."
     exit 1
 fi
+
+# 3. Secret scan — long hex tokens (40+ chars) in staged diff (warning only)
+LEAK=$(git diff --cached -U0 2>/dev/null | grep -iE '[0-9a-f]{40,}' | grep -v 'sha' | head -5)
+if [ -n "$LEAK" ]; then
+    echo "WARN: Possible token/secret in staged diff (review before push):"
+    echo "$LEAK"
+fi
+
+exit 0