chore(ci): gate formatting and PR titles

[Yigtwxx]

What and why

Three gates the contributing rules already describe, none of which anything
enforced.

ruff check and ruff format disagree about different things — the first about
what the code does, the second about how it reads — and only the first was
wired up. The frontend had the same hole for a different reason: next lint is
eslint, which says nothing about formatting, so the format:check script and
the .prettierrc beside it had sat unused since the frontend was created. Nine
files had drifted to whichever indentation their author's editor produced;
chore(frontend): reformat the files prettier had never been run on fixes them
in a separate commit so 285 lines of reindentation do not bury a 49-line
workflow change. Every hunk in it is whitespace.

The PR title check is new. A squash merge writes the title into history, which
makes it the subject line this repository's 72-character Conventional Commits
rule actually applies to — gating the branch commits instead would check text
that gets discarded on merge. The accepted types are the six the convention
lists rather than the wider Conventional Commits vocabulary, so widening the set
stays a visible edit here rather than something that happens by accident.

The title is read through an environment variable rather than a ${{ }}
interpolation into the script. On a public repository the title is
attacker-controlled, and substituting it directly would run whatever a PR author
put after a semicolon.

How it was verified

• cd backend && ruff check . && python -m compileall -q -x "venv|data" . && pytest && ruff format --check .
• cd frontend && npm run lint && npm run typecheck && npm test && npm run build

Beyond the checklist:

• npm run format:check and ruff format --check . — the two new gates — pass
  on this branch, so neither arrives red.
• python scripts/build_agent_skill.py --check and
  python scripts/build_repo_facts.py --check still pass; the reformat touched
  package.json but no generated figure moved.
• The title script was extracted from the workflow and run against a table of
  titles: the five valid shapes above pass (including feat!: and a bare
  docs:), and Update stuff, feature(ui): …, a capitalised description, a
  trailing period, a 98-character subject and a bare feat(ui): each fail with
  the message naming the specific rule.
• Both currently open PRs (chore(backend): remove the RLS workaround SQL from the backend root #1, feat(frontend): render the not-advice caveat on model output surfaces #3) pass the new title gate, so this does not
  block work already in flight.
• Shell injection was tested directly: feat(ui): x; rm -rf / is accepted as a
  well-formed title and nothing executes, which is the point of the env: block.

Screenshots

Not applicable — no UI change. The nine reformatted files render identically;
the diff is indentation only.

Configuration

Nothing here applies.

Notes for the reviewer

No secret-scanning job, deliberately. GitHub's own secret scanning and push
protection are already enabled on this repository, and security_and_analysis
reports both enabled. A second scanner would add a way for the two to
disagree without adding coverage.

This branch push ran no CI. ci.yml listens on push: main and
pull_request: main, so nothing fired until this PR opened. The gates are green
locally; this PR is the first time they run on a runner, and pr-title is
running against its own definition.

Left out on purpose, both worth their own PR:

• concurrency on the workflow, to cancel superseded runs. Five jobs on every
  push gets expensive as PR volume grows, but it is a different concern from
  what is gated.
• Dependabot security updates are currently disabled.

The one judgement call I would push back on if you disagree: restricting types
to the six in the convention means a CI-only change has to be chore, not ci.
That is what this PR did.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B455UiUbbGqda87ZFc9wjb