Add scripts/ops/check_tsapt_pin.sh, which fails when node_modules/ts-apt
is a symlink, package.json does not pin ts-apt to a full commit SHA, or
package-lock.json resolves ts-apt to a link or a different SHA.
Run it from a .githooks/pre-push hook (installed by the npm prepare
script via core.hooksPath) and from the CI action-deps-pinned job, and
document the rule in AGENTS.md.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
