feat(precommit): add check-index target to catch walker-output drift

[bborbe]

Summary

Adds `check-index` to the `make precommit` chain so doc edits that change `### RULE` blocks must also include the regenerated `rules/index.json`. Fail-loud beats silent drift.

Closes the gap exposed by PR #9 → PR #10: PR #9 trimmed a doc with pre-canonicalized rule blocks but didn't run `make build-index` — the 7 new `agent-cmd/*` entries were silently absent from `rules/index.json` until PR #10 retroactively picked them up.

Implementation

`check-index` regenerates the walker output to a tmp file, diffs against committed `rules/index.json`, fails with the diff + actionable instruction if they differ:

```make
.PHONY: check-index
check-index:
@python3 scripts/build-index.py > /tmp/coding-rules-index-check.json
@if ! diff -q rules/index.json /tmp/coding-rules-index-check.json > /dev/null 2>&1; then \
echo "ERROR: rules/index.json is stale. Run 'make build-index' and commit the result."; \
diff -u rules/index.json /tmp/coding-rules-index-check.json | head -40; \
rm -f /tmp/coding-rules-index-check.json; \
exit 1; \
fi
@rm -f /tmp/coding-rules-index-check.json
@echo "rules/index.json up-to-date"
```

Wired into precommit:

```make
precommit: check-links check-json check-index
```

Why diff-not-regenerate

Considered: just run `build-index` in precommit. Rejected — that mutates a committed file silently; precommit "passes" but leaves an uncommitted change in the working tree. Diff-check fails loud and forces the author to run `make build-index` and `git add` it explicitly.

Test plan

• Clean state (master HEAD): `make precommit` passes (`rules/index.json up-to-date`)
• Synthetic drift (appended `{}` to `rules/index.json`): fails with diff + non-zero exit
• Restored state: `make precommit` passes again
• Walker is deterministic ("sorted, byte-stable" per its header) → diff cannot false-positive on insertion-order changes

[ben-s-pull-request-reviewer]

{
  "verdict": "approve",
  "summary": "The check-index target is a well-designed addition that detects when rules/index.json has drifted from its source. The two concerns from planning (diff -q exit code reliability and temp file cleanup) were analyzed and found to be correctly handled in the implementation. One minor observation: if build-index.py fails, Make's default behavior (without set -e) allows the diff step to run against an incomplete temp file, but this is unlikely in practice and the error output would still be informative.",
  "comments": [
    {
      "file": "Makefile",
      "line": 32,
      "severity": "nit",
      "message": "Nice to have: Consider adding '|| true' or explicit error handling after python3 build-index.py to ensure failures are caught. Without set -e, Make continues past non-zero exits from command substitutions. This is minor since build-index.py failures would be caught by pre-existing checks."
    }
  ],
  "concerns_addressed": [
    "correctness: diff -q exit code handling is reliable across bash versions — confirmed",
    "correctness: temp file /tmp/coding-rules-index-check.json IS cleaned up before exit 1 in error path — concern not valid"
  ]
}