Hook lives in .githooks/pre-push (tracked) and runs pytest inside the Docker app container. start.sh auto-configures core.hooksPath so new clones pick it up on first run.
