chore: the pre-push hook refuses unsigned commits for main, as the deploy does

deploy/redeploy.sh deploys main only if every new commit is signed by a key
in deploy/allowed-signers, and finds out after CI. On 2026-10-09 that held
learn.halkyon.eu at v0.2.2 for two days: 37 commits had reached main
unsigned, and every deploy since refused them. tool/check_signatures.sh
applies the same rule to a push, to the commits it brings to main that the
remote doesn't have yet (the list as the pushed commit has it), and
tool/check.sh runs it first when it runs as the pre-push hook: a second,
where the rest takes minutes. CI runs check.sh under its own name and
skips it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MMm7usAo6q9ZZRoPkWjoxi
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

tool/check.sh

@@ -10,6 +10,12 @@
 set -euo pipefail
 cd "$(git rev-parse --show-toplevel)"
 
+# As the pre-push hook, first: commits going to main must be signed as deploying it requires
+# (tool/check_signatures.sh), which takes a moment, where the rest takes minutes.
+if [ "$(basename "$0")" = pre-push ]; then
+  tool/check_signatures.sh "$@"
+fi
+
 if ! git diff --quiet HEAD; then
   echo 'Note: the working tree has uncommitted changes; they are checked too.'
 fi