pre-push(17.6): install, Docker wrapper and first-run docs

`ousast pre-push install|uninstall [REPO] [--force] [--docker]` ships in the
wheel with the hook as package data; it honours core.hooksPath, refuses an
existing hook unless --force (which chains it as pre-push.before-ousast), and
uninstall restores the chained hook. ops/ousast-docker is a hook-callable
script: the repository read-only and the artifact directory at their own
paths, stdin passed through, no network, --memory 3g, the GHCR 2.0.1 image by
default, advisory exit unless blocking. Help text for every pre-push flag; a
first-run guide, settings, skip-reason glossary, CI recipe and full --help in
docs/scanning.md; README tiers 1 and 2 pull the published image. The image
was not rebuilt: 1.1 GB free, below the 4 GB threshold. Requirements 7.4, 9.6.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/test_push_explain.py

@@ -39,6 +39,19 @@ def test_audit_reasons_become_one_plain_line_each():
     assert sum("could not be established" in line for line in lines) == 1
 
 
+def test_every_glossary_reason_is_documented_for_users():
+    """17.6: the skip-reason glossary in docs/scanning.md names every reason the terminal explains."""
+    from pathlib import Path
+
+    from openultrasast.push.explain import _NOVELTY_REASONS, _RESOLUTION, GLOSSARY
+
+    docs = (Path(__file__).resolve().parents[1] / "docs" / "scanning.md").read_text()
+    missing = [key for key in GLOSSARY if key not in docs]
+    missing += [f"resolution:{key}" for key in _RESOLUTION if f"`resolution:{key}`" not in docs]
+    assert not missing, missing
+    assert "base_incomplete" in docs and _NOVELTY_REASONS
+
+
 def test_unknown_reason_is_still_printed():
     assert explain(("some_future_reason",)) == ["some future reason (see the details file)"]