chore(deps): pin @commitlint/config-conventional to 21.1.0 (LIA-437)

[sliamh11]

Summary

• chore(deps): bump @commitlint/config-conventional from 21.1.0 to 21.2.0 (#1000) bumped @commitlint/config-conventional's declared range for conventional-changelog-conventionalcommits from ^9.2.0 to ^10.0.0. The 10.x line is ESM-only (exports map with only import/types conditions, no require/default); commitlint's own @commitlint/resolve-extends resolves extends packages via Node's synchronous require.resolve(), which throws ERR_PACKAGE_PATH_NOT_EXPORTED before ever loading the file.
• Net effect: husky's commit-msg hook aborts every commit, on any branch forked from origin/main after chore(deps): bump @commitlint/config-conventional from 21.1.0 to 21.2.0 #1000 merged.
• Fix: exact-pin @commitlint/config-conventional to 21.1.0 (a caret range alone doesn't work — @commitlint/cli@21.1.0 itself declares its own ^21.1.0 dependency on config-conventional, and since 21.2.0 satisfies that caret range too, npm kept re-resolving upward even with the root range narrowed). Regenerated package-lock.json.
• Added a dependabot.yml ignore rule so the same broken bump isn't immediately re-proposed next week.

Test plan

• rm -rf node_modules && npm ci — clean install
• npm ls @commitlint/config-conventional conventional-changelog-conventionalcommits — resolves to 21.1.0 / 9.3.1 (CJS-compatible)
• echo "test: dummy commit message" | npx commitlint --edit /dev/stdin — exit 0
• Real end-to-end git commit through husky's commit-msg hook succeeds (this PR's own commit)
• dependabot.yml's new ignore block validated as syntactically correct YAML, scoped only to @commitlint/config-conventional
• Native code-reviewer: SHIP
• GPT backend code-reviewer co-gate: SHIP
• Fresh verification-gate: SHIP (independently re-ran every claim above)
• Human review

Linear: LIA-437

🤖 Generated with Claude Code