fix(fmt) + feat(gamepad): CI-matching rustfmt everywhere, enforced by repo git hooks; N4 spike flips to GO via MI_02

Three things that belong together:

1. rustfmt the gamepad-new-types host files ci.yml's `cargo fmt --all
   --check` gate flags (the .21/.133 verify recipes ran clippy+tests
   but never fmt — the same class of miss as 69f30f30).

2. Enforce it at the source: scripts/git-hooks/{pre-commit,pre-push}
   run the exact CI fmt gates (main workspace + the shipped-driver
   crates of the UMDF workspace); CONTRIBUTING documents the one-time
   `git config core.hooksPath scripts/git-hooks`. pre-push is the
   enforcement point (plumbing commits bypass pre-commit).

3. N4 follow-up — the spike verdict FLIPS TO GO: SwDeviceProfile grows
   `usb_mi`, synthesizing `&MI_02` into the Deck spike's USB hardware
   ids. hidclass mirrors the parent's USB tokens into the HID child's
   hardware ids, and hidapi/SDL/Steam parse `MI_` as bInterfaceNumber
   (defaulting to 0 when absent — the exact gate the first run hit:
   Steam wants the Deck controller on interface 2). Re-run live on
   .173: Steam logs `Interface: 2`, then `!! Steam controller device
   opened`, `Steam Controller reserving XInput slot 0`, and activates
   a mapping — full Steam Input promotion of the software-devnode
   Deck, no driver change needed. The PS identities pass
   `usb_mi: None` (real single-interface devices carry no MI_ token).
   A proper Windows-Deck backend phase is now justified; planned
   separately.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/git-hooks/pre-commit

@@ -0,0 +1,9 @@
+#!/bin/sh
+# Repo pre-commit hook: the same rustfmt gates as pre-push, but at commit time for faster
+# feedback. Enable once per clone:
+#
+#     git config core.hooksPath scripts/git-hooks
+#
+# NOTE this is the convenience layer only — plumbing commits (commit-tree) bypass pre-commit,
+# which is why pre-push re-runs the identical checks and is the actual enforcement point.
+exec "$(git rev-parse --show-toplevel)/scripts/git-hooks/pre-push"

scripts/git-hooks/pre-push

@@ -0,0 +1,37 @@
+#!/bin/sh
+# Repo pre-push hook: run the exact rustfmt gates CI runs, so a push can never fail on
+# formatting alone. Enable once per clone:
+#
+#     git config core.hooksPath scripts/git-hooks
+#
+# Kept to the CHEAP checks on purpose (rustfmt only parses — a couple of seconds): clippy/tests
+# stay in CI and the per-box verify recipes. Runs regardless of how the commits were made
+# (plain `git commit`, amends, or plumbing like commit-tree — pre-push sees them all).
+#
+# Escape hatch for a genuine emergency: `git push --no-verify`.
+
+set -eu
+root=$(git rev-parse --show-toplevel)
+
+fail() {
+    echo "pre-push: $1" >&2
+    echo "pre-push: fix with: $2" >&2
+    echo "pre-push: (bypass in an emergency with: git push --no-verify)" >&2
+    exit 1
+}
+
+# 1. Main workspace — mirrors ci.yml "Format": cargo fmt --all --check.
+if ! (cd "$root" && cargo fmt --all --check >/dev/null 2>&1); then
+    fail "main workspace is not rustfmt-clean (ci.yml would fail)" \
+         "cargo fmt --all"
+fi
+
+# 2. UMDF driver workspace — mirrors windows-drivers.yml's gate (the shipped drivers + the
+# audited safe layer; pf-vdisplay is deliberately NOT gated there, so not here either).
+if ! (cd "$root/packaging/windows/drivers" \
+      && cargo fmt -p pf-umdf-util -p pf-xusb -p pf-dualsense --check >/dev/null 2>&1); then
+    fail "driver workspace is not rustfmt-clean (windows-drivers.yml would fail)" \
+         "(cd packaging/windows/drivers && cargo fmt -p pf-umdf-util -p pf-xusb -p pf-dualsense)"
+fi
+
+exit 0