feat: add bump-version.sh script for version management

Automates version bumps across all version source files:
- Cargo.toml (PRIMARY - workspace.package.version)
- debian/changelog (prepend new entry)
- debian/control (update Version field)
- scripts/build-package.sh (update VERSION variable)
- frontend/package.json (update version field)
- Stale references check after bump

Usage: ./scripts/bump-version.sh <new_version> <old_version>

scripts/git-hooks/install.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# =============================================================================
+# Linux Patch Manager — Git Hooks Installer
+# =============================================================================
+# Installs pre-commit and pre-push hooks into .git/hooks/
+# Run from repo root: ./scripts/git-hooks/install.sh
+# =============================================================================
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+HOOKS_DIR="${REPO_ROOT}/.git/hooks"
+SOURCE_DIR="${REPO_ROOT}/scripts/git-hooks"
+
+echo "Installing git hooks from ${SOURCE_DIR} ..."
+
+for hook in pre-commit pre-push; do
+    if [[ -f "${SOURCE_DIR}/${hook}" ]]; then
+        cp "${SOURCE_DIR}/${hook}" "${HOOKS_DIR}/${hook}"
+        chmod +x "${HOOKS_DIR}/${hook}"
+        echo "  ✓ Installed ${hook}"
+    else
+        echo "  ⚠ Skipped ${hook} (not found)"
+    fi
+done
+
+echo "Done. Hooks will run automatically on commit and push."

scripts/git-hooks/pre-commit

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# =============================================================================
+# Linux Patch Manager — Pre-Commit Hook
+# =============================================================================
+# Auto-formats Rust code and runs frontend checks before each commit.
+# Prevents CI format-check and lint failures by catching issues locally.
+# Install: ./scripts/git-hooks/install.sh
+# =============================================================================
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+
+# ── Rust auto-format ──────────────────────────────────────────────────────────
+if [[ -f "${REPO_ROOT}/Cargo.toml" ]]; then
+    echo "[pre-commit] Running cargo fmt --all ..."
+    cargo fmt --all --manifest-path "${REPO_ROOT}/Cargo.toml" 2>/dev/null
+
+    # Re-stage any files that cargo fmt reformatted
+    STAGED_RS=$(git diff --name-only --diff-filter=ACM -- '*.rs')
+    if [[ -n "${STAGED_RS}" ]]; then
+        git add ${STAGED_RS}
+    fi
+fi
+
+# ── Frontend checks ──────────────────────────────────────────────────────────
+if [[ -f "${REPO_ROOT}/frontend/package.json" ]]; then
+    echo "[pre-commit] Running ESLint ..."
+    cd "${REPO_ROOT}/frontend"
+    npx eslint src/ --ext .ts,.tsx --max-warnings 0 2>/dev/null
+
+    echo "[pre-commit] Running TypeScript type check ..."
+    npx tsc --noEmit 2>/dev/null
+fi
+
+echo "[pre-commit] All checks passed ✓"

scripts/git-hooks/pre-push

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# =============================================================================
+# Linux Patch Manager — Pre-Push Hook
+# =============================================================================
+# Safety net: verifies cargo fmt, ESLint, and TypeScript pass before pushing.
+# Install: ./scripts/git-hooks/install.sh
+# =============================================================================
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+FAILED=0
+
+# ── Rust format check ────────────────────────────────────────────────────────
+if [[ -f "${REPO_ROOT}/Cargo.toml" ]]; then
+    echo "[pre-push] Checking Rust formatting ..."
+    if ! cargo fmt --all --manifest-path "${REPO_ROOT}/Cargo.toml" --check 2>/dev/null; then
+        echo "[pre-push] ❌ Rust formatting check FAILED. Run: cargo fmt --all"
+        FAILED=1
+    fi
+fi
+
+# ── Frontend ESLint ──────────────────────────────────────────────────────────
+if [[ -f "${REPO_ROOT}/frontend/package.json" ]]; then
+    echo "[pre-push] Running ESLint ..."
+    if ! (cd "${REPO_ROOT}/frontend" && npx eslint src/ --ext .ts,.tsx --max-warnings 0 2>/dev/null); then
+        echo "[pre-push] ❌ ESLint check FAILED."
+        FAILED=1
+    fi
+fi
+
+# ── Frontend type check ─────────────────────────────────────────────────────
+if [[ -f "${REPO_ROOT}/frontend/package.json" ]]; then
+    echo "[pre-push] Checking TypeScript types ..."
+    if ! (cd "${REPO_ROOT}/frontend" && npx tsc --noEmit 2>/dev/null); then
+        echo "[pre-push] ❌ TypeScript type check FAILED."
+        FAILED=1
+    fi
+fi
+
+if [[ ${FAILED} -ne 0 ]]; then
+    echo "[pre-push] Push rejected — fix errors above before pushing."
+    exit 1
+fi
+
+echo "[pre-push] All checks passed ✓"