feat(ci): relax the branch check to a type shape

[ss-o]

Steps 4 to 6 of #595, completing
decisions/0022-issue-traceability-on-pull-requests.md in this repository.

Step 4 is already done, outside this pull request. Validate Issue Link
was observed passing on #600, so it is now registered in the main ruleset
beside the other three contexts. The other six rules and all four bypass actors
were verified byte-identical before and after.

Step 5: the branch check becomes a shape check

^((feature|bug|hotfix)-[1-9][0-9]*(-[a-z0-9]+)*
 |(feat|fix|perf|refactor|docs|test|build|ci|style|chore|revert|feature|bug|hotfix)/[a-z0-9]+(-[a-z0-9]+)*)$

feature-<id> stays valid and recommended. next keeps its
persistent-integration exemption, and the automation prefixes are unchanged.

Step 6: the amendment is recorded where people read it

ADR-0019 now carries a blockquote beside the clause ADR-0022 changes, and
AGENTS.md states the traceability rule directly. ADR-0022's migration put
this with the enforcement rather than with the record, so the pointer and the
behaviour it describes land together.

Read this before merging

code/ branches are still rejected. code is not in the
decisions/0003-conventional-commits.md type set, and ADR-0022 scoped the
<type>/<slug> form to that set plus feature, bug, hotfix. code/* was
17 of the 46 non-conforming branches in the sample that started this, so the
single most common shape in recent history still fails.

I implemented the accepted decision rather than widening it here. If code
should be an accepted type, that is a one-line change to ADR-0022 and this
pattern, and it should be decided rather than slipped in.

What does now pass that did not: fix/, docs/, chore/, ci/, feat/,
and the other Conventional Commits types, with no identifier.

Verification

The policy suite grows to 56 checks, with the branch table rewritten for the
new shape:

Now allowed	Still rejected
fix/labeler-audit-reject-malformed	code/promotion-precondition-ancestry
docs/adr-0022-rollout	ss-o-govern-plugin-standard
chore/tidy-workflows	fix/Bad-Caps
feature/no-identifier	fix/

All six steps of Validate Agent Instructions pass locally, plus
decision-records.py --check, actionlint, shellcheck and trunk check.

Refs #595