chore(tier2): install pre-commit hook via setup_tier2_clone.ps1

Wires the new pre-commit hook (from conductor/tier2/githooks/pre-commit,
added in 81e1fd7b) into the tier-2 clone setup. Existing tier-2 clones
need to re-run setup_tier2_clone.ps1 to install the hook; new clones
get it automatically.

The forbidden-files.txt config is committed to the clone by the
canonical-source commit (the conductor/tier2/* source), so the hook
can find its config via the project root. If the config is missing
(pre-setup scenario), the hook silently no-ops.

scripts/tier2/setup_tier2_clone.ps1

@@ -113,8 +113,14 @@ extra_dirs = []
 
         # 4. Install git hooks
         Write-Host "[tier2-bootstrap] installing git hooks"
+        Copy-Item -Force "$MainRepoPath\conductor\tier2\githooks\pre-commit" "$Tier2ClonePath\.git\hooks\pre-commit"
         Copy-Item -Force "$MainRepoPath\conductor\tier2\githooks\pre-push" "$Tier2ClonePath\.git\hooks\pre-push"
         Copy-Item -Force "$MainRepoPath\conductor\tier2\githooks\post-checkout" "$Tier2ClonePath\.git\hooks\post-checkout"
+        # The forbidden-files.txt config is committed to the clone (the
+        # setup script also commits the canonical conductor/tier2/* source
+        # in step 1), so the hook can find it via the project root. If the
+        # file is missing, the hook silently no-ops (see hook source).
+        Write-Host "[tier2-bootstrap] git hooks installed (pre-commit auto-unstages sandbox-only files)"
 
         # 5. Create desktop shortcut
         Write-Host "[tier2-bootstrap] creating desktop shortcut"