chore(ai-workflow): track repo-managed review tooling (#1046)

* chore(ai-workflow): track repo-managed review tooling

* fix(ai-workflow): remove repo-specific path assumptions

Make shared workflow hooks and APK testing guidance resolve paths from the repo and contributor environment so the tooling works for all contributors, not just one machine.

.cursor/hooks/format.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# afterFileEdit hook: Auto-format files after AI edits them
+# Receives JSON via stdin: {"file_path": "...", "edits": [...]}
+
+# Read stdin (required for hooks)
+input=$(cat)
+
+# Extract file_path using grep/sed (jq-free for portability)
+file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' | sed 's/.*:.*"\([^"]*\)"/\1/')
+
+# Exit if no file path found
+if [ -z "$file_path" ]; then
+  exit 0
+fi
+
+# Only format JS/TS files
+case "$file_path" in
+  *.js|*.ts|*.tsx|*.mjs)
+    # Match the other hooks by resolving relative paths from the repo root.
+    cd "$(dirname "$0")/../.." || exit 0
+
+    # Run oxfmt on the file (silent on success)
+    npx oxfmt "$file_path" 2>/dev/null || true
+    ;;
+esac
+
+exit 0

.cursor/hooks/verify.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# stop hook: Run build, lint, type-check, and security audit when agent finishes
+# This is informational - always exits 0
+
+# Consume stdin (required for hooks)
+cat > /dev/null
+
+# Change to project directory
+cd "$(dirname "$0")/../.." || exit 0
+
+cleanup_generated_dir() {
+  local path="$1"
+
+  if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    return
+  fi
+
+  if git ls-files --error-unmatch "$path" >/dev/null 2>&1; then
+    if git diff --quiet -- "$path"; then
+      return
+    fi
+
+    echo "=== git restore --worktree $path ==="
+    git restore --worktree -- "$path" 2>&1 || true
+    echo ""
+    return
+  fi
+
+  if [ -e "$path" ]; then
+    echo "=== rm -rf $path ==="
+    rm -rf "$path" 2>&1 || true
+    echo ""
+  fi
+}
+
+echo "Running build, lint, type-check, and security audit..."
+echo ""
+
+# Run build (catches compilation errors)
+echo "=== yarn build ==="
+yarn build 2>&1 || true
+echo ""
+
+# Run lint
+echo "=== yarn lint ==="
+yarn lint 2>&1 || true
+echo ""
+
+# Run type-check
+echo "=== yarn type-check ==="
+yarn type-check 2>&1 || true
+echo ""
+
+# Run security audit
+echo "=== yarn audit ==="
+yarn audit 2>&1 || true
+echo ""
+
+cleanup_generated_dir build
+cleanup_generated_dir dist
+
+echo "Verification complete."
+exit 0

.cursor/hooks/yarn-install.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# afterFileEdit hook: Run yarn install when package.json is changed
+# Receives JSON via stdin: {"file_path": "...", "edits": [...]}
+
+# Read stdin (required for hooks)
+input=$(cat)
+
+# Extract file_path using grep/sed (jq-free for portability)
+file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' | sed 's/.*:.*"\([^"]*\)"/\1/')
+
+# Exit if no file path found
+if [ -z "$file_path" ]; then
+  exit 0
+fi
+
+# Only run yarn install if package.json was changed
+if [ "$file_path" = "package.json" ]; then
+  # Change to project directory
+  cd "$(dirname "$0")/../.." || exit 0
+  
+  echo "package.json changed - running yarn install to update yarn.lock..."
+  yarn install
+fi
+
+exit 0