fix: read validate.sh fallback hash from shared sha256 file

[N4M3Z]

Problem

.githooks/pre-commit pins validate.sh at f1fc47c4… while the script on forge-cli main hashes to 55998b60…, so the no-prek/no-forge fallback always exits with a hash mismatch. Each hook carrying its own pinned hash drifts silently.

Fix

The hash lives once in .githooks/validate.sh.sha256; pre-commit reads it from there.

Out of scope

The forge-cli init template still embeds the hash into each hook at init time; moving the template to the shared-file layout is a forge-cli change. The in-flight Entire-chained pre-push.pre-entire hook should read the same file when it lands.

Test plan

• shellcheck clean
• Fallback verified end-to-end: fetched validate.sh from forge-cli main, hash matches the shared file