ci: enforce the commit format CLAUDE.md said was enforced

CLAUDE.md has claimed since the file was written that commitlint gates
the commit format in CI and that semantic-release runs off it. There was
no commitlint config, no workflow running one, and nothing invoking
.releaserc.yml — so the first thing every contributor and every agent
reads about this repo was false in two places.

scripts/commit-check.sh is the smaller honest answer: the grammar is one
regex, and commitlint would mean a Node dependency tree at the root of a
Go repo to run it. It is a commit-msg hook locally and a CI step over
every commit in a push, and its type list is .releaserc.yml's so the
check and the release rules cannot drift.

The semantic-release half is recorded as configured-but-not-wired rather
than implied to run.

lefthook.yml

@@ -2,6 +2,13 @@
 # Install with: lefthook install
 # Docs: https://github.com/evilmartians/lefthook
 
+# Conventional Commits. CI runs the same script over every commit in a
+# push, so skipping this locally only defers the failure.
+commit-msg:
+  commands:
+    commit-check:
+      run: ./scripts/commit-check.sh {1}
+
 pre-commit:
   parallel: true
   commands: