fix(security): replace npx with npm exec in pre-commit hook

[frankieyan]

Overview

npx can silently fetch and execute packages from the npm registry if a matching local install is missing or if a package name is typosquatted. Since lint-staged is already an explicit devDependency, using npm exec instead ensures we only run the locally installed version, closing a potential supply-chain attack vector.

Test plan

• Stage a file with a lint issue and commit
  • lint-staged runs and catches the issue
• Stage a clean file and commit
  • Commit succeeds normally

🤖 Generated with Claude Code

[doistbot]

This PR updates the pre-commit hook to use npm exec instead of npx when running lint-staged, which is a great step toward securing our tooling against potential supply-chain attacks. However, since modern npm versions still fetch missing packages with npm exec, an explicit --no flag is needed to fully enforce using only the locally installed version.

_{Share Feedback • Review Logs}

[doistbot]

[P1] npm exec without --no still fetches missing packages

The PR description states that switching to npm exec ensures only the locally installed version is run. However, in modern npm (v7+), npm exec and npx share the same underlying behavior: if the package is missing locally, both will attempt to fetch it or prompt the user to install it.

To effectively close this supply-chain attack vector and strictly enforce using only the local installation, you must explicitly pass the --no flag to disable fetching. You can use either npm exec --no -- lint-staged or npx --no lint-staged.

Suggested change

	npm exec lint-staged
	npm exec --no -- lint-staged