Semantic commits job: add PR-title lint and validate trusted actors on title, not generated bodies

[rubicon]

The Semantic commits job in .github/workflows/pr-policy.yaml has two gaps that
together keep every Dependabot PR (#1 through #5) red.

Gap 1: no PR-title lint

The adopted Conventional Commits standard includes "semantic prefix also linted on
the PR title." The repo lints commits but never the PR title. A PR whose commits
happen to be conventional could still carry a non-conventional title and merge
(the title becomes the squash-merge subject, so it matters).

Gap 2: the job does not consume the trusted-actor classification

pr-policy.yaml already classifies trusted automation in the actor job, and
Branch naming and Issue link both needs: actor and exempt it from the rules
it cannot satisfy. Semantic commits is the only policy job that does not consume
actor. It runs commitlint over the full commit range, including Dependabot's
generated bodies.

Those bodies carry long lines (dependency-compare URLs). The wagoid action bundles
an older commitlint that flags them as body-max-line-length errors. Result: every
Dependabot PR fails Semantic commits on a body no human wrote and cannot fix.

The maintainer policy is explicit that the trusted-automation exemption covers
branch naming and issue linking only, and that bots remain subject to a Conventional
Commits PR title. So the fix is not to waive commit linting for bots wholesale, and
not to waive body-max-line-length for humans, but to validate trusted actors on
their title and stop linting their generated bodies.

Fix

• Add needs: actor to the Semantic commits job.
• Lint the PR title for every actor (the missing standard). Bot titles like
  ci: bump actions/checkout from 5.1.0 to 7.0.1 are already conventional and pass.
• Lint commit bodies for human PRs only (if: needs.actor.outputs.trusted != 'true'),
  keeping body-max-line-length enforced for humans exactly as today.

The job name stays Semantic commits, so the branch-protection required check is
unchanged.

The policy also notes these exemptions should ship with the workflow from the start
rather than be added reactively after a bot PR is found blocked. This corrects that
omission in the scaffold.

Verification

The title lint is verified locally against the repo's own commitlint.config.mjs:
it passes valid human, Dependabot, and release-please titles, and fails a title with
no type, a capitalized type, and an unknown type. Full confirmation that Dependabot
PRs #1 through #5 flip to green requires this fix on main and a rebase of those
branches, because pull_request checks run the workflow the PR branch carries.