test(ci): cover the commit-lint policy patterns

[ss-o]

Closes #592.

commit-lint.yml carries three policy gates whose entire logic is inline shell
and regular expressions. Three defects have shipped in it, and nothing
automated caught any of them:

Issue	Defect	How it was found
#575	Workflow never started; 53 of 53 runs startup_failure	Someone read the run conclusions
#586	workflow_call defaults do not apply on a pull_request run, so both patterns would have been empty: every commit flagged, every branch passed	Reading the diff
#587	grep -q under pipefail fails open on a large commit message	Reading the diff

Two of the three were silent. actionlint passes all of them.

Design

Every pattern is extracted from the workflow, never restated:

Extracted	From
DISALLOWED_TRAILER_PATTERN	the : "${VAR:=...}" fallback
BRANCH_PATTERN	the : "${VAR:=...}" fallback
CONVENTIONAL_PATTERN	its assignment
Allowed automation prefixes	the grep -qE guard in the branch job

A test carrying its own copy of a regex drifts from the thing it claims to
check and then proves nothing. A failed extraction is a hard failure, not a
skip: it means the workflow changed shape and the test has to be re-pointed.

Alongside the pattern cases, three checks assert the constructs, because
that is where two of the three defects lived:

• no git show | grep -q on the trailer pipeline (fix(ci): commit-lint trailer guard fails open on large commit messages #587)
• an in-step fallback for each pattern (fix(ci): run commit lint directly so the policy gate executes #586)
• no workflow_call input default: that a pull_request run would ignore (fix(ci): run commit lint directly so the policy gate executes #586)

Verification

40 checks pass. More usefully, the suite was mutation-tested: six
deliberate regressions introduced one at a time, each reverted after.

Mutation	Result
Reintroduce grep -q on the trailer pipeline	caught
Remove the BRANCH_PATTERN in-step fallback	caught
Loosen the branch pattern to accept feature-0	caught
Drop the copilot/ and codex/ prefixes	caught
Widen the trailer pattern so it bans human co-authors	caught
Raise the subject-length cap past 72	caught

Six of six. That is the thing this file has never had: evidence the test
detects the failure, not just that it passes against a known-good input.

bash -n, shellcheck -s bash, actionlint, and trunk check are clean.

Notes

The suite is Bash with a declared floor of 4.0, per
.github/instructions/shell.instructions.md, which requires the dialect to be
declared before applying language rules.

z-shell/zi carries the same three jobs with its patterns inlined rather than
behind workflow_call fallbacks. The extractors here are anchored to this
repository's shape, so porting the suite needs its own change; ADR-0022 step 5
already flags those two copies as a drift risk. Not attempted here.