Load and dispatch check hooks over the `Session` (hook axis)

[redeboer]

Summary

Define how the individual check hooks are loaded and dispatched over the Session. This is axis (3) of the epic — the hooks direction of extensibility.

Each check becomes a transformation over the shared session, with its dispatch and file-trigger metadata declared through @check_hook:

@check_hook(group="python", paths=["pyproject.toml"])
def check(session: Session, args: Arguments, context: CheckContext) -> None:
    ...  # read/mutate containers obtained through the session

flush() at the end writes every changed file once and returns the aggregated changelog.

Requirements

1. Single source of truth for order. CHECK_HOOKS is the one explicit ordered sequence of hook definitions. Running with every group (the default) must reproduce the original flat check-dev-files dispatch order exactly; a subcommand filters that sequence to its own group. A subcommand can therefore never order a shared config file (for example .pre-commit-config.yaml) differently from the full run.
2. Group gating. Keep the Group = Literal["python", "github", "env", "nb", "format", "repo"] gating so subcommands run a subset.
3. Easy to extend. A check declares its group, enable predicate, and relevant files locally through @check_hook; adding it to the dispatch order is a one-line, order-explicit addition to CHECK_HOOKS.
4. Derived file triggers. The union of the file metadata on CHECK_HOOKS produces the pre-commit file filter for check-dev-files.

Depends on

• Stop using PrecommitError to signal "a file was changed" #620 (axis 1) — checks must report changes as values, not exceptions.
• axis (2) — the Session container the hooks dispatch over.

Part of the epic (link in parent).