fix(hooks): limit pre-push AI attribution check to commits since latest release

Only check commits after the latest published release tag instead of scanning
entire history. This prevents false positives from old commits with AI
attribution that are already on origin/main from merged PRs.

Changes:
- Find latest v* tag merged into branch being pushed
- Only scan commits after that tag
- Fall back to full history if no release tags exist
- Applies to both new branches and existing branches

Benefits:
- No false positives from historical commits
- Faster push validation
- Still blocks new AI attribution in unpublished code

Author: jdalton

.git-hooks/pre-push

@@ -26,11 +26,26 @@ TOTAL_ERRORS=0
 while read local_ref local_sha remote_ref remote_sha; do
   # Get the range of commits being pushed.
   if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
-    # New branch - check all commits.
-    range="$local_sha"
+    # New branch - find the latest published release tag to limit scope.
+    latest_release=$(git tag --list 'v*' --sort=-version:refname --merged "$local_sha" | head -1)
+    if [ -n "$latest_release" ]; then
+      # Check commits since the latest published release.
+      range="$latest_release..$local_sha"
+    else
+      # No release tags found - check all commits.
+      range="$local_sha"
+    fi
   else
-    # Existing branch - check new commits.
-    range="$remote_sha..$local_sha"
+    # Existing branch - check new commits since remote.
+    # Limit scope to commits after the latest published release on this branch.
+    latest_release=$(git tag --list 'v*' --sort=-version:refname --merged "$remote_sha" | head -1)
+    if [ -n "$latest_release" ]; then
+      # Only check commits after the latest release that are being pushed.
+      range="$latest_release..$local_sha"
+    else
+      # No release tags found - check new commits only.
+      range="$remote_sha..$local_sha"
+    fi
   fi
 
   ERRORS=0