Block commit types outside the allowed set

[fcakyon]

The commit-staged skill lists seven allowed types, but nothing enforced them, so chore: slipped into three commits today.

• denies any commit type outside the seven
• catches chained commands the existing confirm hook misses
• 15 tests: heredocs, apostrophes, --amend, Codex argv arrays

$ git add -A && git commit -m "chore: bump versions"
"chore" is not an allowed commit type. Use one of feat, fix, refactor, docs,
style, test, build, written as type then a colon then a brief description.
Pick the type that fits and commit again.

A commit with no -m passes, since the subject lives in the editor where the hook cannot see it. That also lets a conflicted merge keep git's generated subject.