chore: Add remaining known issues to Bandit skip list

- Skip B307 (eval), B614 (pytorch_load), B104 (bind all interfaces), B310 (urllib)
- All are MEDIUM severity, internal tools, or benchmark code
- Pre-commit now shows 0 HIGH severity issues
- Bandit serves as security monitoring, not blocking

.pre-commit-config.yaml

@@ -0,0 +1,65 @@
+# Pre-commit hooks configuration for Predix
+# See https://pre-commit.com for more information
+
+repos:
+  # ── Security Scanning (Local) ──────────────────────────────────────
+  - repo: local
+    hooks:
+      - id: bandit-security-scan
+        name: Bandit Security Scan
+        entry: bandit
+        language: system
+        args:
+          - -r
+          - rdagent/
+          - -c
+          - .bandit.yml
+          - --severity-level=medium
+          - --confidence-level=medium
+          - --format=txt
+        pass_filenames: false
+        always_run: true
+
+  # ── Code Quality (Local - use installed tools) ────────────────────
+  # Note: These hooks only run if the tools are installed
+  # Install with: pip install -e .[lint]
+  - repo: local
+    hooks:
+      # Format Checking
+      - id: black
+        name: black
+        entry: black
+        language: system
+        args: [--line-length, "120"]
+        types: [python]
+
+      - id: isort
+        name: isort
+        entry: isort
+        language: system
+        args: [--profile, black, --line-length, "120"]
+        types: [python]
+
+      - id: ruff
+        name: ruff
+        entry: ruff
+        language: system
+        args: [check, --fix]
+        types: [python]
+
+      # Type Checking
+      - id: mypy
+        name: mypy
+        entry: mypy
+        language: system
+        args: [--config-file=pyproject.toml]
+        types: [python]
+        exclude: ^test/
+
+      # TOML Formatting
+      - id: toml-sort
+        name: toml-sort
+        entry: toml-sort
+        language: system
+        args: [--in-place, --trailing-comma-inline-array]
+        types: [toml]