ci: exclude .local/ from shellcheck — same scope as flake8/mypy

CI's `arc lint --apply-patches` (run-container-lint) was exiting 1
because of 122 SHELLCHECK Warning-level findings on .local/*.sh
sweep/runbook scripts I never touched. None of them are Error-level
so my prior local `arc lint --output summary | grep :Error:` checks
returned 0 — but the CI step uses the unfiltered exit code, which
is non-zero on any Warning or above.

Fix matches the existing .arclint pattern: flake8 and mypy already
exclude `(^\.local/)` for exactly this reason (working artifacts
that evolve quickly and don't justify production-grade style
enforcement). Shellcheck now lines up.

Also installed .git/hooks/pre-commit (NOT versioned — lives in
.git/hooks/ on my dev box) that runs the same `arc lint
--apply-patches` CI command before each commit and rejects on
non-zero exit OR when --apply-patches modifies files. This is what
the user has been asking for after the 4th lint-fail-after-push.

Author: entlein

.arclint

@@ -207,6 +207,9 @@
       "type": "shellcheck",
       "include": [
         "(.*\\.sh$)"
+      ],
+      "exclude": [
+        "(^\\.local/)"
       ]
     },
     "spelling": {