chore: add rubocop pre-commit hook and fix all offenses

[chorrell]

Summary

• Adds rubocop v1.86.2 to .pre-commit-config.yaml with language_version: 3.4.7 (highest version in pre-commit's bundled ruby-build)
• Adds .rubocop.yml — enables new cops, suppresses extension suggestions, excludes spec/ from Metrics cops, and disables Naming/FileName since Dockerfile_spec.rb names are intentional
• Adds .ruby-version (3.4.9) for local rbenv
• Fixes all rubocop offenses across the codebase:
  • String literals → single-quoted
  • Hash syntax → Ruby 1.9 style (key: vs :key =>)
  • ENV['TARGET_HOST'] → ENV.fetch('TARGET_HOST', nil)
  • Redundant string escapes in npm_tests.rb
  • target[1..-1] → target[1..] in Rakefile
  • "#{tag}" → tag.to_s in Dockerfile specs

Notes

• pre-commit's language: ruby hook uses its own isolated rbenv — it doesn't share with the system rbenv. The language_version: 3.4.7 tells pre-commit which Ruby to build for the hook environment; .ruby-version: 3.4.9 is for local project use via rbenv.
• All 12 pre-commit hooks pass locally.

Test plan

• CI passes
• pre-commit run --all-files passes locally (requires rbenv + Ruby 3.4.x)

🤖 Generated with Claude Code