fix(ci): run commit lint directly so the policy gate executes

[ss-o]

Root cause

lint-commits.yml declared workflow-level permissions: {} and then called
commit-lint.yml, whose commit-message job requests contents: read. A
called workflow's jobs cannot hold more permission than the caller job, so
GitHub rejected the run at creation time. Every run since the workflow landed
in #517 recorded startup_failure:

gh api repos/z-shell/.github/actions/workflows/lint-commits.yml/runs \
  --jq '[.workflow_runs[].conclusion] | unique'
["startup_failure"]

gh api repos/z-shell/.github/check-suites/90220512465 \
  --jq '{conclusion, latest_check_runs_count}'
{"conclusion":"startup_failure","latest_check_runs_count":0}

No check runs and a 404 on the logs endpoint, which is why the failure stayed
invisible. actionlint passes the pair cleanly, so nothing local caught it.

The other two causes suggested in #575 are not involved. The regex defaults are
single-quoted YAML scalars and parse literally, and a local ./ reusable
reference resolves normally for a same-repository pull_request.

Fix

commit-lint.yml now carries the pull_request trigger and concurrency group
itself and keeps workflow_call for other repositories. lint-commits.yml is
deleted. That is the shape already proven in this repository by
labels-sync-test.yml, repo-settings-audit-test.yml, and
labeler-config-audit-test.yml, and in z-shell/zi:.github/workflows/commit-lint.yml,
where the same three jobs report success.

A second defect would have surfaced the moment the workflow started running.
workflow_call input defaults are not applied to a pull_request run, where
the inputs context is empty, so DISALLOWED_TRAILER_PATTERN and
BRANCH_PATTERN would both have expanded to the empty string. An empty
grep -E pattern matches every line, which means every commit would have been
flagged as carrying a bot trailer and every branch name would have passed
silently. The fallbacks now live in the job steps as : "${VAR:=default}", and
the on.workflow_call.inputs.*.default values are gone so there is one source
of truth per pattern.

The unused pull-requests: read is dropped from the commit-message job. It
reads git history only, and a lower ceiling is one less permission a future
caller has to grant.

PATTERNS.md records the caller-permission ceiling and the input-default trap.

Verification

• actionlint and trunk check are clean on both files.
• The fallback patterns were exercised directly: a [bot] trailer is blocked,
  a human Co-authored-by is allowed, a plain subject is unaffected, and
  bug-575 matches the branch pattern while code/foo and next do not.
• Running the new job logic over this branch's own commits gives
  errors=0 checked=2.
• This pull request is the live verification fix(ci): Lint Commits fails at startup so commit policy is unenforced #575 asked for. Validate Commits, Validate PR Title, and Validate Branch Name should all appear
  and pass here for the first time.

Follow-up for a maintainer

1. The main ruleset still requires no status checks. Once the three contexts
   are observed on this pull request they can be added to
   required_status_checks. runbooks/branch-protection.md notes that GitHub
   only accepts contexts it has already seen. Because the workflow is no longer
   nested, the contexts are Validate Commits, Validate PR Title, and
   Validate Branch Name, without a commit-lint / prefix.
2. This workflow has never executed, so the next pull request opened from a
   code/* or codex/* branch will fail Validate Branch Name against
   ^(feature|bug|hotfix)-[1-9][0-9]*$ from decisions/0019. That is the policy
   working rather than a regression from this change. Widening the pattern is a
   separate decision.

Closes #575