fix: lint full promotion range on dev push (#186)

[MongLong0214]

Closes #186

Problem

The demo-lint workflow only triggered on pull_request events, so it linted only a PR's own commits. Two commits that duplicate a Record-Id (like the known r-readme729 collision between 051fee9 and a2c657a) appear together only in the full origin/main..dev range — which nothing checked until a promotion PR was opened.

Fix

Add a promotion-range-lint job to demo-lint.yml that fires on push to dev and validates origin/main..HEAD. The existing PR lint job is unchanged.

Backlog check

Running node dist/commitlore.mjs validate --range origin/main..origin/dev --json at dev head 6b4b725 returned 0 violations, 0 secrets — the first push will not be red.

Verification

• Focused test (test/action-lint.test.ts): 28 tests pass
• Mutation oracles: removing dev from push branches fails; changing range from origin/main..HEAD fails
• Both typechecks pass (tsconfig.json, bench/tsconfig.json)
• Full suite (60 files, 1568 tests) passes (guard.test.ts/inject.test.ts/bench-exposure.test.ts/gate-a-e2e.test.ts excluded — hang on this machine at unmodified dev head)

[github-actions]

CommitLore — record lint

Trailers: clean — 1 commit in origin/dev..35141b2a12821b3db8192c4a42e75b5d87b180e8
Active constraints: 1 limits · 3 ruled-out · 2 warnings — from 3 records over 2 changed paths

Active constraints for the paths this PR touches

Limits (1)

• r-3f7a29 49817dc — reconstruction reads text written before the protocol existed, so the evidence is thinner than a harvest and the discard rate is expected to be high

Ruled out (3)

• r-3f7a29 49817dc — repair a draft that fails verification | backfill's source material is weak enough that a repair loop would mostly be inventing
• r-3f7a29 49817dc — write reconstructed records into commit messages | history rewriting is irreversible and reaches every existing clone
• r-3f7a29 49817dc — post a fresh comment per push | it turns the signal into noise and the check gets muted

Warnings (2)

• r-1a63f5 2bb4993 (claim) — "CI is green" was said five times today against a red CI, including in the commit that introduced the rule saying to check CI before saying it. The rule is in docs/RELEASE-GATE.md §5 and it was not followed by its own author. This commit is not claiming CI is green; that claim comes after the run reports
• r-3f7a29 49817dc (claim) — every backfilled record is Provenance: reconstructed, which the trust model always renders as a claim -- do not add a path that lets a draft override that field

git log --follow accepts exactly one pathspec, so renames are not followed for 2 paths; query one path at a time to follow its rename chain

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}