Publish reusable commit and pull-request title conformance workflows

[szmyty]

Why

A local Commitizen prompt improves authoring, but the shared guarantee must live in CI. The fleet currently has divergent or missing commit policies and no reusable Relay workflow that applies the canonical contract consistently to pull requests and protected branches.

Scope

• Wrap the canonical EgoLint commit and pull-request-title validator as a reusable workflow.
• Validate the pull-request title and the intended resulting default-branch commit.
• Optionally validate all commits in a pull request where the repository policy requires it.
• Handle merge, squash, rebase, bot, release, revert, dependency, generated, and breaking-change cases.
• Pin action and tool versions and emit machine-readable evidence.
• Support observe, ratchet, and enforce modes.
• Provide a fixture consumer and migration guidance for existing local workflows.
• Publish stable required-check names suitable for an organization ruleset.

Acceptance criteria

• A reusable workflow consumes a pinned EgoLint release and canonical contract version.
• Required check names are stable across repositories.
• Fork pull requests use least-privilege permissions and do not expose secrets.
• Failure messages show the expected format and exact violated rule.
• Bot/release/generated allowances are fixture-tested.
• Observe and ratchet outputs are consumable by Pace and Observatory.
• The workflow can be selected by an organization ruleset after the pilot succeeds.

Dependencies

• Hygiene canonical commit/change-history contract
• EgoLint canonical commit validator
• Relay#49
• Relay#5