The guard only ran inside a backend pytest shard, so a citation in
SCSS or JSX surfaced minutes after the push. The pre-commit hook now
runs the same test file in --staged mode on every staged app file,
reusing its patterns and PENDING allowlist so the two cannot drift.