Poetry must be preferred over standalone prek because local hooks
(pylint, bandit, safety, vulture, trufflehog) are Python dev
dependencies installed via Poetry. When only standalone prek is
available, warn that these hooks will fail without the deps.
Detect prek from PATH first (brew, npm global, pipx), then fall
back to Poetry. This allows UI-only contributors to use prek
without needing Poetry installed.