ci: 让测试真的跑起来（Gitea Actions + pre-push 钩子）

`node --test tests/` 在 Node 22 上根本不工作 —— Node 把路径当模块加载，
报 "Cannot find module .../tests"，退出码 1，零个测试执行。而这条命令在
CLAUDE.md 里被当作标准用法记了很久。这大概就是这套断言从来没人跑起来的
一个主要原因：照文档敲，得到一个看不懂的错误。

正确形式是裸 `node --test`（自动发现 **/*.test.mjs）。四处全改，并加断言
钉住 —— 我自己第一版钩子和 workflow 也照抄了那个错误形式，实测才发现
它会无条件拦住每一次 push。

- .gitea/workflows/tests.yml：Gitea 原生位置。用 node 容器而非 setup-node，
  自建 Gitea 上后者要从 GitHub 拉，是新 runner 上又一个可能缺的东西。
  容器 tag 与 NODE_VERSION 绑定，否则 CI 测的运行时和出货的不是一个。
- .github/workflows/tests.yml：镜像一份，断言保证两边执行内容一致。
- .githooks/pre-push：不依赖任何 runner 的兜底。实测过它会拦下失败的 push。
  写明 --no-verify 怎么跳过 —— 拦不掉的钩子会被第一个被卡住的人删掉。

为什么需要钩子这一层：这台 Gitea 的 Actions 是开着的，但推上去的 workflow
产生了 0 次运行（total_count: 0），runner API 要鉴权查不了，最可能是没注册
runner。钩子是唯一完全不需要服务端支持的一层。

CLAUDE.md 补上 `git config core.hooksPath .githooks` —— 钩子是 per-clone 的，
没人替你装。

CLAUDE.md

@@ -52,8 +52,12 @@ cd bootable
 ### Tests
 
 ```bash
-node --test tests/              # Run all tests (node:test, no test framework dep)
-node --test tests/windows-launchers.test.mjs   # Run one test file
+node --test                     # Run every test (node:test, no framework dependency)
+node --test tests/windows-launchers.test.mjs   # Run one file
+
+# NOT `node --test tests/` — Node reads that path as a module to load and dies
+# with "Cannot find module". That form was documented here for years, which is
+# a good part of why the suite went unrun.
 ```
 
 Tests assert on the **text/behavior of the launchers and shared `.mjs` helpers** — e.g. that the
@@ -61,8 +65,22 @@ Start launchers stay thin shells over `lib/start.mjs`, that `.bat` files are pur
 that no China-routed download source comes back, that the two installers resolve skills the same
 way, and that every message key exists in every catalogue. They read repo files as strings; they
 do **not** spawn OpenClaw. There is no root
-`package.json`. **As of 2026-08-17 tests do run in CI** — `.github/workflows/tests.yml` runs
-`node --test tests/` on every push and PR. Before that they were local-only, so the guards they
+`package.json`.
+
+**Enable the pre-push hook after cloning** — it is per-clone and nothing installs it for you:
+
+```bash
+git config core.hooksPath .githooks
+```
+
+It runs the suite and the generated-file check before anything leaves your machine.
+`git push --no-verify` skips it. This matters because CI cannot be relied on here:
+the suite went unrun for the whole life of the upstream project, and on our own
+Gitea the workflow produced zero runs — most likely no runner is registered. The
+hook is the one layer that works with no server support at all.
+
+**As of 2026-08-17 tests also run in CI where a runner exists** — `.github/workflows/tests.yml` runs
+`node --test` on every push and PR. Before that they were local-only, so the guards they
 encode could regress unnoticed.
 
 **CI workflows** (`.github/workflows/`): `release.yml` builds Win/Mac portable + desktop and