chore(pre-commit): SHA-pin a2ml + k9 hooks (#37)

## Summary

`.pre-commit-config.yaml` used `rev: main` for both
`hyperpolymath/a2ml-pre-commit` and `hyperpolymath/k9-pre-commit`,
meaning every clean `pre-commit install` could pull a different commit.
Neither hook repo cuts tags, so SHA pinning is the right discipline.

Pinned to current `main` HEAD on both repos:

| Hook | SHA | Date | Commit |
|---|---|---|---|
| a2ml-pre-commit | `cee7b74f` | 2026-05-22 | `chore: migrate license
from PMPL-1.0-or-later to MPL-2.0` |
| k9-pre-commit | `18bcd863` | 2026-05-22 | `chore: migrate license from
PMPL-1.0-or-later to MPL-2.0` |

Mirrors the SHA-pinning already done in `.github/workflows/` for the
same actions (commits e2e8a01, 0dd6990, a91b583, 35fb302).

## Test plan

- [x] SHAs verified via `gh api
repos/hyperpolymath/a2ml-pre-commit/commits/main --jq .sha`
- [ ] CI on PR: the workflows that call those actions (dogfood-gate)
stay green
- [ ] Local: `pre-commit run --all-files` works against the pinned SHAs

## Bump recipe

Comment in the file gives the one-liner: `gh api
repos/hyperpolymath/a2ml-pre-commit/commits/main --jq .sha`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.pre-commit-config.yaml

@@ -19,15 +19,18 @@ repos:
         args: ['--maxkb=1024']
 
   # --- A2ML manifest validation ---
+  # SHA-pinned (neither hook repo cuts tags). Bump by running
+  # `gh api repos/hyperpolymath/a2ml-pre-commit/commits/main --jq .sha`
+  # (and the k9 equivalent) and replacing the rev when a refresh is needed.
   - repo: https://github.com/hyperpolymath/a2ml-pre-commit
-    rev: main
+    rev: cee7b74f1b9c3da521e9d05999552fa4d03b8b28  # main @ 2026-05-22
     hooks:
       - id: validate-a2ml
         name: Validate A2ML manifests
 
   # --- K9 contract validation ---
   - repo: https://github.com/hyperpolymath/k9-pre-commit
-    rev: main
+    rev: 18bcd863af84d9dea24e14fae5c1f6afa10f6866  # main @ 2026-05-22
     hooks:
       - id: validate-k9
         name: Validate K9 contracts