What task are you trying to do?

Add a CI check that lints commit messages in a PR against Conventional Commits (feat:, fix:, refactor:, docs:, chore: …), matching the AGENTS.md convention.

Context

Split out of #54 (P3 polish). Separate from title-lint (#68) because the two target different artifacts. Upstream-sync squash commits need an allowlist or the check must only run on non-sync PRs.

What would a good result look like?

• Non-conforming commit messages surface on the PR (advisory check).
• Upstream-sync PRs (graft + squash merge) do not trigger false positives.
• Action SHA-pinned (D5 policy from [Feature] Harden CI as a real merge gate for dev #54).

Audience

Maintainers.