ci: adopt the shared reusable workflows and org lint baseline

[Bryan Fawcett (bryanfawcett)]

Why

This repository was created empty. Meanwhile the org ruleset
mukoko-dev/org-wide-main-protection (created 2026-09-11) already requires five
status checks on the default branch of every repository in the org:

lint / actionlint
lint / JSON validity
lint / prettier
lint / markdownlint
lint / yamllint

Nothing in mukoko-dev could produce those contexts, and a required context
that never reports is permanently pending — so PRs here could never merge. This
PR is self-satisfying: it introduces the very checks the ruleset is waiting for.

Call, don't copy

nyuchi/.github is public, and a reusable workflow in a public repository
can be called from any repository in any organisation — private callers
included. So the workflows here are thin callers, not copies.

I verified that in production rather than assuming it:

• mzizi-dev/agent-tools is a private repository in a different org and
  its lint.yml calls nyuchi/.github/.github/workflows/reusable-lint.yml@main
  — three green runs today.
• bundu-labs/marketing consumes seven of the same reusables, and
  bundu-labs/.github has exactly this three-file shape.
• mukoko-dev org Actions policy is allowed_actions: all, so nothing blocks it.

Duplicating the library into a second org would double the maintenance surface
and let the copies drift silently. The README says so explicitly, and says what
to do if a genuine divergence is ever needed.

Contents

file	purpose
.github/workflows/lint.yml	the five required contexts
.github/workflows/pr-title-lint.yml	Conventional Commits on the PR title — the ruleset is squash-only, so the title becomes main's commit subject
.github/workflows/stale.yml	scheduled stale sweep
.prettierrc, .prettierignore, .markdownlint.jsonc, .yamllint.yaml, .editorconfig	the org lint baseline the tools auto-discover
README.md	why the caller job must be named lint, and the per-project reusable map

The lint job name is load-bearing

A job that calls a reusable workflow publishes its checks as
<caller job> / <called job>. Defining the five as ordinary top-level jobs
makes them report as bare actionlint, JSON validity, … — the required
contexts never report, and every PR in the repository blocks forever while
every visible check stays green. That is precisely the live failure in
nyuchi/zti-app (nyuchi/zti-app#45 fixes it). The README documents this so the
next repository doesn't repeat it.

Verification

All five checks run locally against this branch and pass — actionlint rc=0,
JSON validity rc=0, yamllint rc=0, prettier clean, markdownlint-cli2
0 error(s). They should also go green on this PR, which is itself the proof
that cross-org reuse works from mukoko-dev. Proof that they can still fail
is in the PR conversation.

Public repository

No private repository names, internal hostnames or secrets appear in any file
here.