Switch hadolint to hadolint-coatl in the dev extra

The ``hadolint-py`` wheel published on PyPI for macOS is a corrupt
archive and fails to extract, so it cannot be used as a dependency.
Use ``hadolint-coatl`` instead, and run it through a ``local`` prek
hook so that its version is managed alongside the other tools in the
``dev`` extra, matching how ``shellcheck`` and ``shfmt`` are handled.

Closes #3427

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: adamtheturtle

prek.toml

@@ -98,16 +98,6 @@ hooks = [
   }
 ]
 
-[[repos]]
-repo = "https://github.com/AleksaC/hadolint-py"
-rev = "v2.15.1"
-hooks = [
-  {
-    id = "hadolint",
-    stages = ["pre-commit"]
-  }
-]
-
 [[repos]]
 repo = "local"
 hooks = [
@@ -134,6 +124,15 @@ hooks = [
     additional_dependencies = ["uv==0.11.7"],
     stages = ["pre-commit"]
   },
+  {
+    id = "hadolint",
+    name = "hadolint",
+    entry = "uv run --extra=dev hadolint",
+    language = "python",
+    types_or = ["dockerfile"],
+    additional_dependencies = ["uv==0.11.7"],
+    stages = ["pre-commit"]
+  },
   {
     id = "pydocstringformatter",
     name = "pydocstringformatter",

pyproject.toml

@@ -61,6 +61,10 @@ optional-dependencies.dev = [
     "docker==7.2.0",
     "freezegun==1.5.5",
     "furo==2025.12.19",
+    # We use ``hadolint-coatl`` rather than ``hadolint-py`` because the
+    # ``hadolint-py`` macOS wheel published on PyPI is a corrupt archive and
+    # cannot be installed.
+    "hadolint-coatl==2.15.1",
     "interrogate==1.7.0",
     "mypy[faster-cache]==2.3.1",
     "mypy-strict-kwargs==2026.8.25.1",