chore: CI meta-gates (branch-protection contexts sync, commit-types sync) #10

Problem

Branch-protection JSON and pr-title.yml allow-lists drift independently from ci.yml jobs and pyproject.toml commitizen schema. Without an automated check, the drift is invisible until something breaks.

Proposed solution

Port .github/scripts/check_required_contexts.py (fails if a ci.yml job exists but is missing from branch-protection JSON). Port .github/scripts/check_commit_types.py (fails if commitizen schema_pattern disagrees with pr-title.yml allowed types). Wire both as CI jobs.

Acceptance criteria

• check_required_contexts.py runs in CI and exits non-zero on drift.
• check_commit_types.py runs in CI and exits non-zero on drift.
• A unit test ports from Teller's tests/test_check_commit_types.py to lock down the parsing logic.

Priority rationale

High: meta-gates are what distinguish a maintained harness from a snapshot. Without them, the harness rots.

Depends on

#9