usage: pactkit commit-gate [-h] [--hook] [--push-gate] [--post-commit]
                           [--install-git-hook] [--full] [--pre-commit-entry]
                           [--pre-push-entry] [--secrets-entry]
                           [--pre-commit-setup] [--install] [--migrate]
                           [--check] [--uninstall-chain]

options:
  -h, --help          show this help message and exit
  --hook              PreToolUse hook mode: read hook JSON from stdin, exit 2
                      blocks git commit
  --push-gate         Protected-branch push gate: block direct pushes to
                      main/master (pre-push hook entry point; exit 1 blocks)
  --post-commit       RETIRED (architecture slimming): the post-commit stamp
                      is replaced by commit-identity evidence. Prints a
                      notice, exits 0 (migration window for lingering hooks).
  --install-git-hook  RETIRED: git hooks are owned by pre-commit now. Prints a
                      notice, exits 0 — use `pactkit commit-gate --install
                      --migrate`.
  --full              Manual complete entry: run the complete declared test
                      set (tests/, every runner) instead of the fast local
                      selection. Branch permission gates still apply. The hook
                      never adds this.
  --pre-commit-entry  pre-commit hook entry: the PactKit domain check (repo-
                      level, no file list, single execution — pass_filenames:
                      false). Scheduled by pre-commit; do not invoke before
                      commits yourself.
  --pre-push-entry    pre-commit pre-push hook entry: protected-branch push
                      policy from PRE_COMMIT_* env vars. No tests run here.
                      pre-commit limits: a multi-refspec push surfaces only
                      its first ref, and a remote-ref deletion does not run
                      this stage at all (see `pactkit doctor`).
  --secrets-entry     pre-commit hook entry: credential scan of the staged
                      files (upstream detect-secrets-hook from PactKit's
                      install environment). Scheduled by pre-commit; do not
                      invoke before commits yourself.
  --pre-commit-setup  Explicit fresh integration: write .pre-commit-
                      config.yaml (repo: local, language: system) and let pre-
                      commit install the hooks. Existing configs without
                      PactKit hooks are refused — use the migration flow for
                      those.
  --install           Explicit integration / migration entry (STORY-
                      slim-2026091769e0a79767ff R1). With --check: read-only
                      preflight. With --migrate: also replace pristine old
                      PactKit wrappers (backup + pre-commit install); user-
                      modified hooks are never touched.
  --migrate           With --install: migrate old PactKit wrappers to the pre-
                      commit chain (five-state matrix; conflicts stop before
                      any write).
  --check             With --install: read-only migration preflight (no files
                      created or modified).
  --uninstall-chain   Remove PactKit's pre-commit hook entries; user checks,
                      their shims and baselines are preserved.
