ci: run pre-commit on pull requests

[mscolnick]

What / why

This repo ships a .pre-commit-config.yaml, but nothing was actually running it: pre-commit.ci is not installed on this repo, and no CI workflow invoked the hooks. That means contributors without local pre-commit installed silently bypass trailing-whitespace/EOF, YAML, and ruff (lint + format) checks — the config was dead weight.

This adds a pre-commit GitHub Actions workflow that runs the existing hooks on every pull request (and on pushes to main), so the config is actually enforced.

The workflow

• Runs uvx pre-commit run --all-files --show-diff-on-failure via astral-sh/setup-uv.
• Read-only (permissions: contents: read) — it reports failures with a diff rather than auto-pushing fixes.
• Caches ~/.cache/pre-commit keyed on the config hash.
• All actions are SHA-pinned, matching this repo's existing workflow pin style.

Autofixes included

None — running pre-commit run --all-files on main passes cleanly today:

trim trailing whitespace.................................................Passed
fix end of files.........................................................Passed
check yaml...............................................................Passed
check for merge conflicts................................................Passed
ruff.....................................................................Passed
ruff-format..............................................................Passed

Part of the marimo-team engineering-excellence initiative to make sure every repo's declared quality gates actually run in CI.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.