feat(actions): lint pull request titles and commits with commitlint

[davidmoralesz]

What

ci-pr checked titles and commits with check-conventional-commit.sh, a regex that accepts any scope. This repo's own hooks used commitlint. So there were two definitions of a valid commit, and no project's scope list was enforced.

pr-checks now:

• installs commitlint with npm ci from its own package-lock.json (no install scripts, runner's Node);
• lints the title and each commit against commitlint.default.yaml, which matches what the script accepted (known type, optional lowercase scope, a description, ! allowed);
• adds the rules of the caller's .commitlintrc.yaml when it has one, so a repository can make its scopes binding.

A repository with no .commitlintrc.yaml is held to the same rules as before.

Security

A commitlint config can name JavaScript through extends, plugins and parserPreset. lint.mjs reads only rules from the caller's file, writes its own config, and runs commitlint from an empty directory, so a pull request still cannot get code executed. test-hooks.sh has a case for it.

Not in this PR

• check-conventional-commit.sh and the conventional-commit pre-commit hook stay until the consumers have moved off them.
• This repo's own commitlint.config.mjs is not read by ci-pr; converting it to .commitlintrc.yaml comes with the mise change.

Tested

• bash .devtools/test-hooks.sh: all pass, including 15 new cases for lint.mjs.
• prettier --check ., actionlint, shellcheck, check-action-pins.sh: clean.
• zizmor: clean on a tree without node_modules.
• Not tested: the action running from a consumer repository. self-pr on this PR exercises it same-repo; a consumer draft PR pointed at this branch is still needed before merge, as AGENTS.md asks. Draft until then.