Reinstate Secure Tools commit-message convention

[maruson08]

Objective

Reinstate and enforce the established Secure Tools commit-message format from this point forward.

Scope

• Document the canonical <Gitmoji>[<Action>] <imperative subject> convention
• Add a zero-dependency repository validator and focused tests
• Validate non-merge commits introduced by each pull request
• Validate new pull-request titles using the same structural convention
• Preserve normal merge commits and all published history

Acceptance criteria

• All 14 fixed Gitmoji/action pairs are accepted and mismatched or malformed prefixes are rejected
• Merge commits are skipped by topology rather than subject text
• CI checks only the actual pull-request base-to-head range
• Existing branch-policy and release-safety safeguards remain intact
• The implementation PR targets v2.1 and remains open for review

This issue does not authorize rewriting history, merging into v2.1 or main, or creating a release/tag.

[maruson08]

Completed by PR #82, merged into v2.1 as 9e959b6.