GRM-41: feat: enforce commit naming conventions and workflow discipline

.gitea/workflows/ci.yml

@@ -94,6 +94,33 @@ jobs:
             echo "No user-facing files changed — skipping release dry-run."
           fi
 
+  validate-merge:
+    if: github.event_name == 'push'
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+      - name: Validate commit message format
+        run: |
+          set -euo pipefail
+          MSG=$(git log -1 --pretty=%s)
+          echo "Commit message: $MSG"
+          # Allowed formats:
+          #   GRM-N <type>: <description>     (squash-merge)
+          #   release: vX.Y.Z                  (release commits)
+          #   GRM-N <type>: <description> (#M) (squash-merge with PR ref)
+          if echo "$MSG" | grep -qE '^GRM-[0-9]+ [a-z]+: .+'; then
+            echo "OK: GRM-N <conventional> format"
+          elif echo "$MSG" | grep -qE '^release: v[0-9]+\.[0-9]+\.[0-9]+'; then
+            echo "OK: release commit format"
+          else
+            echo "FAIL: commit message does not follow naming convention"
+            echo "Expected: GRM-N <type>: <description> or release: vX.Y.Z"
+            echo "Got:      $MSG"
+            exit 1
+          fi
+
   discover-runners:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.ansible-changed == 'true'