fix(#107): add gitlint rule for forbidden type+scope combos

[fullsend-ai-coder]

Add a custom gitlint LineRule (UL1) that rejects commits using forbidden type(scope) combinations from COMMITS.md: fix(ci), feat(ci), fix(e2e), feat(e2e). Register the rule directory via extra-path in .gitlint so it runs in both the pre-commit hook and the commit-lint CI job.

Add a test script (gitlint-forbidden-type-scope-test.sh) that validates the rule rejects all four forbidden combinations (including with breaking-change markers) and accepts valid type(scope) pairs like ci(pipeline), chore(ci), fix(#123).

Note: pre-commit could not run in the sandbox (shellcheck-py install blocked by network policy, exit code 3). The post-script runs an authoritative pre-commit on the runner.

---

Closes #107

Post-script verification

• Branch is not main/master (agent/107-add-forbidden-type-scope-rule)
• Secret scan passed (gitleaks — 8fb64a25b70e4d364f6d535bb252c1bad521629d..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[rh-hemartin]

/fs-fix the executable gitlint is not being installed on script-tests add it under "Install test dependencies"

[fullsend-ai-coder]

🤖 Finished Fix · ❌ Failure · Started 6:52 AM UTC · Completed 7:00 AM UTC
Commit: 2941769 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 7:45 AM UTC · Completed 7:55 AM UTC
Commit: 1d04364 · View workflow run →

[fullsend-ai-retro]

PR #119 added a custom gitlint rule (UL1) enforcing COMMITS.md forbidden type+scope combinations, closing issue #107. The code agent's implementation was functionally correct but missed updating the CI workflow to install gitlint-core as a test dependency — the sandbox pre-installed it, masking the gap. CI script-test failed. A human /fs-fix request triggered the fix agent, which correctly identified the one-line fix but could not push because modifying .github/workflows/ requires the workflows permission the GitHub App token lacks. The human manually pushed the identical fix. The post-script push error handler also misclassified the permission rejection as non-fast-forward, wasting a retry. Overall: 5 agent runs (2 triage, 2 code, 1 fix) plus significant human intervention for a 185-line change. The first code cycle (PR #110, prompt-based fix) was wasted — already tracked in issue #118.

Proposals filed

1. Code agent should verify CI workflow installs new test dependencies it introduces — The sandbox pre-installs tools that CI may not have, causing tests to pass in-sandbox but fail in CI.
2. Post-script push error handler should detect workflow-permission rejections distinctly — The push error grep matches 'rejected' too broadly, misclassifying permission errors as non-fast-forward and wasting a retry attempt.

Proposals filed

• Code agent should verify CI workflow installs new test dependencies it introduces (in fullsend-ai/agents)
• Post-script push error handler should detect workflow-permission rejections before retrying (in fullsend-ai/agents)