ci: lint every commit in a pull request, not only its title

[dougborg]

Summary

The owner's merge rule is now rebase merges only, with linear history: no squash merges and no merge commits (dougborg/dougborg-dot-net#511). With rebase, every commit in a pull request lands on main as written, and release-please derives versions and changelogs for client and mcp from each one. Today nothing lints commit messages here; malformed types just silently skip a bump.

• Commit check: adds .github/workflows/commitlint.yml (workflow Commit conventions, job Conventional commits). It runs @commitlint/cli 21.2.3 (pinned) over base..head of the pull request, using only the checkout (v7.0.1) and setup-node (v7.0.0) SHAs already pinned in ci.yml. Top-level permissions: {}, job-level contents: read, persist-credentials: false.
• Linter config: .commitlintrc.json extends @commitlint/config-conventional with a type list matching the changelog-sections in release-please-config.json (build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test). Body and footer line length are unlimited, because Dependabot bodies carry release notes.
• Dependabot: every entry now uses prefix: chore with include: scope, so commits read chore(deps): bump … / chore(deps-dev): bump … instead of the double-scoped chore(deps)(deps): …. The ecosystem is still visible from the labels.
• Auto-merge: dependabot-auto-merge.yml now runs gh pr merge --auto --rebase instead of --squash. The existing guard is unchanged: it only acts when both the PR author and the event sender are dependabot[bot] (ID 49699333), so a manually rebased head (which loses the bot's verified signature) stays under manual review, and fetch-metadata keeps commit verification on. The workflows README documents the new job and the --rebase switch; the repo's mdformat hook also rewrapped three existing paragraphs in that README.

Signed commits: nothing in this repository requires them. The only ruleset (Protect Main) has deletion, non_fast_forward, required_linear_history, pull_request, copilot_code_review, required_status_checks; there is no classic branch protection (so no required_signatures). Rebase merges are therefore not blocked by a signature rule.

After this merges and the check is green, dougborg/dougborg-dot-net#511 switches this repository and its Protect Main ruleset to rebase-only, and adds Conventional commits as a required check.

Test plan

• commitlint over the whole history (1,184 commits): 63 commits with errors, 34 with warnings only (footer-leading-blank). Errors are historical and informational: subject-case 34, header-max-length 18, type-empty/subject-empty 13 (non-Conventional subjects), type-enum 1.
• A Dependabot-style chore(deps): bump x from 1 to 2 message with a >100-character body line passes; a bare "Update the readme" fails
• actionlint, zizmor 1.25.2, and pre-commit (mdformat, yamllint, pytest) pass on the changed files
• The new Conventional commits job passes on this PR

🤖 Generated with Claude Code