pre-commit.sh ran 'git add --all .' so 'pre-commit run' could see the
newly rendered files. The side-effect was that copier exited with
template files staged in the index, which renovate's copier manager
treats as 'created' rather than 'not_added' and silently drops from
its artifact list — see release-platform-canary!66 for an example
where every new file from a v1.46.0 -> v1.47.0 update was lost.

- Switch the migration to 'pre-commit run --all-files', which runs
  hooks against all files without needing them staged. Same scope,
  no index pollution.
- Add a 'migration-scripts-no-git-add' rule to the Duo review
  instructions so future migrations can't reintroduce the
  staging-stages-files-renovate-loses-them regression.

fix(migration): stop staging files in pre-commit migration

See merge request !662