Adopt scripts-to-rule-them-all: script/ entrypoints, Makefile shims, policy update

script/install-precommit

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# script/install-precommit: install the git pre-commit hook that runs
+# script/precommit. Our own extension to scripts-to-rule-them-all.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    local hook=".git/hooks/pre-commit"
+    printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
+    chmod +x "$hook"
+    echo "pre-commit hook installed: runs script/precommit"
+}
+
+main "$@"