ci: enforce the commit format CLAUDE.md said was enforced

CLAUDE.md has claimed since the file was written that commitlint gates
the commit format in CI and that semantic-release runs off it. There was
no commitlint config, no workflow running one, and nothing invoking
.releaserc.yml — so the first thing every contributor and every agent
reads about this repo was false in two places.

scripts/commit-check.sh is the smaller honest answer: the grammar is one
regex, and commitlint would mean a Node dependency tree at the root of a
Go repo to run it. It is a commit-msg hook locally and a CI step over
every commit in a push, and its type list is .releaserc.yml's so the
check and the release rules cannot drift.

The semantic-release half is recorded as configured-but-not-wired rather
than implied to run.

.gitea/workflows/ci.yml

@@ -88,6 +88,24 @@ jobs:
           # has to be willing to operate on a directory it does not own.
           git config --global --add safe.directory /src
 
+      # Conventional Commits.  `.releaserc.yml` has always derived the
+      # version from the commit type; until now nothing checked that the
+      # type was one it recognises, so a malformed subject silently meant
+      # "no release".  BEFORE is the push's previous tip and is absent or
+      # all-zeros for a new branch, in which case only the tip is linted.
+      - name: Commit messages
+        working-directory: /src
+        env:
+          BEFORE: ${{ github.event.before }}
+        run: |
+          set -eu
+          if [ -n "${BEFORE:-}" ] && [ "${BEFORE#0000000}" = "$BEFORE" ] \
+             && git cat-file -e "$BEFORE^{commit}" 2>/dev/null; then
+            make commit-check RANGE="$BEFORE..$SHA"
+          else
+            make commit-check
+          fi
+
       - name: Go toolchain
         run: |
           set -eu