feat: Automate ConfigMap checksum updates via Git pre-commit hook

- Add pre-commit hook (scripts/hooks/pre-commit) that automatically calculates
  MD5 checksums of ConfigMaps (element-values.yaml, synapse-values.yaml)
- Update annotations in kustomization.yaml to trigger Flux CD HelmRelease syncs
- Add install script (scripts/install-hooks.sh) for easy hook setup
- Add comprehensive documentation (docs/ops-configmap-sync.md) explaining:
  * Why Flux doesn't auto-detect ConfigMap changes
  * How the checksum-based workaround works
  * How to install and use the hook
  * Troubleshooting and manual sync procedures
- Update README.md with post-clone hook installation step

This solves the issue where Flux CD doesn't automatically re-deploy when external
ConfigMaps are modified. Users no longer need manual checksum updates.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

scripts/hooks/pre-commit

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# GitOps ConfigMap Checksum Hook
+# Automatically updates checksum annotations in kustomization.yaml when ConfigMaps change.
+# This ensures Flux CD re-deploys the HelmRelease when external ConfigMap sources are modified.
+#
+# See: docs/ops-configmap-sync.md
+
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+ELEMENT_VALUES="$REPO_ROOT/apps/production/custom-configs/element-values.yaml"
+SYNAPSE_VALUES="$REPO_ROOT/apps/production/custom-configs/synapse-values.yaml"
+KUSTOMIZATION="$REPO_ROOT/apps/production/kustomization.yaml"
+
+# Function to calculate MD5 hash (handles both GNU md5sum and BSD md5)
+get_md5() {
+  local file="$1"
+  if command -v md5sum &> /dev/null; then
+    md5sum "$file" | awk '{print $1}'
+  elif command -v md5 &> /dev/null; then
+    md5 -q "$file"
+  else
+    echo "ERROR: Neither md5sum nor md5 found" >&2
+    exit 1
+  fi
+}
+
+# Update checksums for ConfigMaps that exist and are staged
+if git diff --cached --name-only | grep -q "element-values.yaml"; then
+  ELEMENT_HASH=$(get_md5 "$ELEMENT_VALUES")
+  sed -i.bak "s/value: \"[0-9a-f]\{32\}\" *# element-config/value: \"$ELEMENT_HASH\" # element-config/" "$KUSTOMIZATION"
+  rm -f "$KUSTOMIZATION.bak"
+  git add "$KUSTOMIZATION"
+fi
+
+if git diff --cached --name-only | grep -q "synapse-values.yaml"; then
+  SYNAPSE_HASH=$(get_md5 "$SYNAPSE_VALUES")
+  sed -i.bak "s/value: \"[0-9a-f]\{32\}\" *# synapse-config/value: \"$SYNAPSE_HASH\" # synapse-config/" "$KUSTOMIZATION"
+  rm -f "$KUSTOMIZATION.bak"
+  git add "$KUSTOMIZATION"
+fi

scripts/install-hooks.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Install Git Hooks for GitOps automation
+# Must be run after cloning the repository
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || {
+  echo "❌ Not in a git repository"
+  exit 1
+}
+
+HOOKS_DIR="$REPO_ROOT/.git/hooks"
+HOOK_SOURCE="$REPO_ROOT/scripts/hooks/pre-commit"
+HOOK_DEST="$HOOKS_DIR/pre-commit"
+
+# Verify source exists
+if [ ! -f "$HOOK_SOURCE" ]; then
+  echo "❌ Hook source not found: $HOOK_SOURCE"
+  exit 1
+fi
+
+# Create symlink (force if exists)
+mkdir -p "$HOOKS_DIR"
+ln -sf "../../scripts/hooks/pre-commit" "$HOOK_DEST"
+chmod +x "$HOOK_SOURCE"
+
+echo "✅ Git hooks installed:"
+echo "   • pre-commit: ConfigMap checksum auto-update"
+echo "   See: docs/ops-configmap-sync.md"