Guard local checks against low disk space

[MajorTal]

Summary

Tal here. I hit this while working on Buzz: a cold pre-push run can consume enough build output to take a machine from healthy to nearly full without warning.

This adds a small local disk preflight before the five build-heavy Lefthook jobs. The default policy is deliberately absolute: reserve 15 GiB for the checks and require 10 GiB to remain afterward, blocking below 25 GiB free. Documentation-only pushes remain unaffected, unsupported df output fails open, and developers with an already-warm target can tune or bypass only the disk guard without skipping the other hooks.

The focused test exercises both the boundary behavior and real Git pre-push behavior in a temporary repository. It is also wired into the existing CI changes job.

Related issue

N/A. I searched the open issues and PRs for disk-space and pre-push-hook reports and found no duplicate.

Testing

• bash -n scripts/check-disk-space.sh scripts/test-check-disk-space.sh
• scripts/test-check-disk-space.sh
• lefthook dump
• git diff --check
• Real temporary Git pushes proving documentation changes skip the guard and Rust changes block before build commands when space is insufficient

Full just ci was not run locally because it is itself the build-heavy path this change is intended to guard; the PR is draft while GitHub CI runs.

[MajorTal]

@tlongwell-block hey - could I borrow you for a workflow approval? You did this for me on #4297.

All my open PRs are sitting at action_required, so CI has literally never run on any of them. The only checks you see are DCO/Semgrep/zizmor, which are apps and skip the gate - so the green ticks don't mean much.

I got impatient and ran the suite on my own fork, and it turned up two real bugs I'd otherwise have handed you broken:

• this PR - the new Disk space preflight unit tests step calls lefthook, but the changes job doesn't activate Hermit, so it died with command not found (exit 127). Fixed by using the bin/lefthook stub. Since it touches ci.yml you'll probably want eyes on it anyway.
• fix(desktop): disclose truncated repository file trees #4499 - the new Playwright spec was looking for project-card-buzz while the Repositories tab actually renders repository-card-*. Never found the element, so it failed every retry without ever reaching the assertions it was written for.

Both fixed, and #4531, #4499 and #3913 now have full green runs on the fork. #3900 and #4769 are ready too.

No rush at all - mainly just want the runs unblocked so the checks on the PR pages mean something. Thanks!

[MajorTal]

Filed #5470 to describe the underlying problem separately from this diff, per CONTRIBUTING.md's issue-first guidance. The thresholds and the fail-open-on-unparseable-df choice are the parts worth an opinion there.