ci: add pre-commit GitHub Actions workflow

Add automated pre-commit check workflow that runs on PRs and pushes to main.
Uses caching to optimize performance - runs full check when config changes,
otherwise only checks modified files for faster feedback.

This ensures all commits meet linting standards before merge.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Signed-off-by: dann frazier <dann.frazier@chainguard.dev>

Author: dannf

.github/workflows/pre-commit.yaml

@@ -0,0 +1,42 @@
+name: pre-commit
+
+on:
+  push:
+    branches:
+      - "main" # required to create a usable cache for other PRs
+  pull_request:
+    branches:
+      - "main"
+
+permissions: {}
+
+jobs:
+  lint:
+    name: pre-commit checks
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0 # required for --from-ref and --to-ref
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - run: |
+          python -m pip install pre-commit
+          python -m pip freeze --local
+      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        id: cache
+        with:
+          path: ~/.cache/pre-commit
+          key: ${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
+      # A cache miss means that the pre-commit config changed and we should check everything
+      # Otherwise, we can just check modified files which will be much faster
+      - if: steps.cache.outputs.cache-hit != 'true'
+        run: pre-commit run --show-diff-on-failure --color=always --all-files
+      - if: steps.cache.outputs.cache-hit == 'true'
+        run: pre-commit run --show-diff-on-failure --color=always --from-ref HEAD^^^ --to-ref HEAD