ci(commitlint): un-skip promotion PRs; ignore historical bootstrap commit instead

Previous commit 34e0e34 over-corrected by skipping commitlint on every
next → main promotion PR, hiding a future class of CC violations sneaking
through admin-bypass direct pushes.

Properly:
- commitlint workflow back to skipping ONLY sync PRs (head_ref=main).
  Promotion PRs (head=next, base=main) lint the full aggregate again.
- commitlint.config.mjs grows an ignores predicate for the one
  historical commit (888977d) whose 'merge:' prefix isn't a CC type.
  That commit landed via admin bypass before stricter branch protection
  was in place. Acknowledged + scoped opt-out, not a relaxed rule.

Follow-up needed: tighten branch protection on main + next to disallow
admin bypass so this class of leak can't happen again.

.github/workflows/commitlint.yml

@@ -30,17 +30,12 @@ jobs:
   lint:
     name: Lint commit messages
     runs-on: ubuntu-latest
-    # Skip on:
-    #   • Automated `main → next` sync PRs (head_ref=main) — the commit
-    #     range includes autogenerated `Merge pull request #N from …`
-    #     titles from prior promotions.
-    #   • Promotion PRs `next → main` (head_ref=next, base_ref=main) —
-    #     same reason on the other side: these aggregate the full next
-    #     history including merge commits and the occasional bootstrap
-    #     commit that pre-dated the strict CC convention.
-    # Each individual contributor PR was already linted before landing
-    # on next, so no CC coverage is lost.
-    if: github.head_ref != 'main' && !(github.head_ref == 'next' && github.base_ref == 'main')
+    # Skip on automated `main → next` sync PRs (head_ref=main): the
+    # commit range includes the autogenerated `Merge pull request #N
+    # from …` titles from prior promotions, which intentionally don't
+    # follow Conventional Commits. Each individual contributor PR was
+    # already linted before landing on main.
+    if: github.head_ref != 'main'
     steps:
       - uses: actions/checkout@v6
         with:

commitlint.config.mjs

@@ -52,4 +52,14 @@ export default {
     // scopes appear naturally as the codebase grows.
     'scope-empty': [0],
   },
+  // Historical opt-out: one bootstrap commit (`888977d`) landed on
+  // `next` via admin bypass before stricter branch protection was in
+  // place. Its `merge:` prefix isn't a CC type. We acknowledge the
+  // leak by ignoring this specific commit message rather than relaxing
+  // type-enum (which would invite future "merge:" misuse) and rather
+  // than skipping commitlint on the entire promotion PR (which would
+  // hide future leaks).
+  ignores: [
+    (msg) => msg.startsWith('merge: bring main 1.0.43 promotion commit into next'),
+  ],
 };