Add a commitlint workflow so PRs in .github report the required check

[davison]

Goal

The org ruleset require-lint demands a "Lint commit messages" status check on every public repo's main, and codecrew's task finish refuses NO_CHECKS on a PR with no checks; .github has no workflow that runs on pull_request, so PR #36 cannot merge. Add a per-repo commitlint workflow to .github modelled on ha-sinkhole's .github/workflows/commitlint.yml (job name must produce the check context "Lint commit messages"; check what context ha-sinkhole's actually reports and match it), with whatever commitlint config and package manifest it needs kept minimal. Do not touch the two reusable release workflows or the calculate_version action. Operator decision recorded on radiusred/ops#1. Once this lands, the open task #35 (PR #36) is rebased so the check reports there.

Requirements

M1-R2

Plan

Requirement covered: M1-R2 (as amended on radiusred/ops#1 — the commitlint workflow reporting the org-required check).

Findings that shape the plan:

• The org ruleset require-lint (id 17497708) requires a status check whose context is exactly Lint commit messages, on the default branch of every public repo.
• ha-sinkhole's commitlint.yml job has no name:, so its check reports as commitlint (seen on ha-sinkhole PR #117) — that does not match the ruleset. It also needs a package.json + lock file and a Node setup step.
• codecrew-www's ci.yml job is named Lint commit messages, uses wagoid/commitlint-github-action@v6 with a root commitlint.config.mjs extending @commitlint/config-conventional, and its PRs pass the ruleset. That is the minimal shape that produces the exact context.

Intended changes (two files, nothing else):

1. .github/workflows/commitlint.yml — on: pull_request, permissions: contents: read, one job commitlint with name: Lint commit messages, steps: actions/checkout@v4 (fetch-depth: 0) then wagoid/commitlint-github-action@v6. The action bundles commitlint and config-conventional, so no package.json / lock file is needed.
2. commitlint.config.mjs at the repo root — extends: ['@commitlint/config-conventional']. The action's default config path is commitlint.config.mjs in the checkout root.

Untouched: reusable-release.yml, reusable-finalize-release.yml, .github/actions/calculate_version/. No overlap with PR #36's file list (CONTRIBUTING.md, _config.yml, doc/, docs/, index.html, mkdocs.yml, requirements.txt).

Verification (the test for a workflow is its own run): because the workflow file rides in the PR head, the check runs on this PR itself. I will wait for it, confirm via the checks API that the reported context is exactly Lint commit messages and that it passed against this PR's conventional commits, and state the observed context in the PR description. YAML is also validated locally before commit.

Commits: one conventional commit, ci: add a commitlint workflow reporting Lint commit messages (#37), on the branch task start creates from main.

Ask-the-human points

None. The operator's Decision on radiusred/ops#1 already settles the scope (per-repo copy now, reusable workflow_call later); the choice of the www shape over the ha-sinkhole shape is recorded as a Decision comment, since the task text names ha-sinkhole as the model but its actual check context does not match the ruleset.

[radiusred-cody]

Decision: model the workflow on codecrew-www's ci.yml (job name: Lint commit messages, wagoid/commitlint-github-action@v6, root commitlint.config.mjs) rather than ha-sinkhole's commitlint.yml.
Trade-off: ha-sinkhole's job has no name: and reports the context commitlint (ha-sinkhole PR #117), which the org ruleset require-lint does not accept; it also carries a package.json, a lock file and a Node setup step. The www shape produces the exact required context, is already proven against the ruleset on www's PRs, and needs two files instead of four. Pinning to @v6 (a major tag) follows the existing org convention in www rather than a SHA pin; tightening that is out of this task's scope.
Rejected: copying ha-sinkhole verbatim and adding name: to its job — works, but keeps the manifest and lock file the task asked to keep minimal.

[radiusred-cody]

Started by @radiusred-cody[bot].