⚙️[Chore] Reinstate Secure Tools commit convention

[maruson08]

Result

Secure Tools now has one documented and testable commit convention: <Gitmoji>[<Action>] <imperative subject>. The repository-owned validator accepts only the 14 fixed Gitmoji/action pairs, reports offending commit SHAs and subjects, and rejects mismatched pairs, spacing errors, empty subjects, unknown actions, and repeated Conventional Commit syntax.

The existing Validate static tools workflow checks only non-merge commits in the pull request’s actual base-to-head range and checks the pull request title with the same structural rule. Technical merge commits are excluded by topology, so the established normal merge-commit workflow remains supported. Published history is unchanged.

Changes

• Add concise agent and development-workflow guidance
• Add the zero-dependency Node validator and focused accepted/rejected tests
• Cover range validation and multi-parent merge exclusion with a temporary Git graph
• Add PR commit-range and PR-title validation to the existing required CI job
• Add CI contract coverage and a dedicated local test script

Verification

• npm run test:commit-messages
• node scripts/validate-commit-message.mjs --range origin/v2.1 HEAD
• compliant PR-title validation
• npm test
• npm run build
• node tests/ocr-smoke.test.mjs
• git diff --check

Tracks #81.

This PR targets v2.1 and remains unmerged for explicit review. It does not rewrite history, change product behavior, promote to main, or create a release/tag.