ci: add PR-title commitlint as a standalone workflow

Pulls the conventional-commit check out of ci.yml's lint job into its
own workflow (.github/workflows/pr-title.yml) so it exposes a stable,
isolated status-check name that branch protection on develop and main
can require independently.

Why this matters: the repo enforces squash-merge, so the PR title
becomes the commit message on develop/main. semantic-release then reads
that message through commitlint.config.js's type-enum to decide whether
to cut a release. PR #245 ("release: audit...") squashed to a
non-conventional commit, semantic-release silently exited with "no
release", and that's the trap that produced the v0.15.0 stale-version
tag. Blocking non-conventional titles at the merge gate stops it
recurring.

The new workflow uses the env-var pattern for github.event.pull_request.title
(never interpolating it directly into a run: command) and printf '%s'
instead of echo to avoid PR titles starting with -e/-n being interpreted
as echo flags. Co-required with the upcoming branch-protection update
(Phase 0 C2) which will mark PR title / commitlint as required.

Author: tomymaritano

.github/workflows/ci.yml

@@ -71,11 +71,9 @@ jobs:
       - name: Prettier
         run: pnpm format:check
 
-      - name: Commitlint (PR title)
-        if: github.event_name == 'pull_request'
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-        run: echo "$PR_TITLE" | pnpm commitlint
+      # PR title commitlint moved to .github/workflows/pr-title.yml so it
+      # exposes a stable, standalone status-check name for branch protection
+      # (squash-merge makes the PR title the release-trigger commit message).
 
   # ── Tier 1: Tests + Coverage ───────────────────────
   test:

.github/workflows/pr-title.yml

@@ -0,0 +1,54 @@
+name: PR title
+
+# Runs commitlint against the PR title as a standalone status check.
+#
+# Why standalone (and not a step inside ci.yml `lint`):
+# - The repo enforces squash merges (see GitHub Settings > Pull Requests).
+#   On squash, the PR title becomes the commit message on develop/main.
+# - semantic-release then analyses that message with the type-enum from
+#   commitlint.config.js to decide whether to cut a release. If the type
+#   isn't recognised (e.g. PR #245's "release: audit..."), semantic-release
+#   silently exits with "no release". This is the trap that blew up
+#   v0.15.0.
+# - Pulling the check into its own workflow gives it a clear, stable
+#   status-check name so branch protection on develop and main can require
+#   it independently of the broader CI lint job.
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  contents: read
+
+concurrency:
+  # Re-running on title edits is cheap; cancel any in-flight check for
+  # the same PR when a new event arrives.
+  group: pr-title-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  commitlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v5
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      # Title check only needs commitlint + its config — no workspace
+      # native deps, no postinstall.
+      - name: Install commitlint
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Lint PR title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          printf '%s' "$PR_TITLE" | pnpm commitlint