chore: CI meta-gates (branch-protection contexts sync, commit-types sync)

[constk]

Problem

Branch-protection JSON and pr-title.yml allow-lists drift independently from ci.yml jobs and pyproject.toml commitizen schema. Without an automated check, the drift is invisible until something breaks.

Proposed solution

Port .github/scripts/check_required_contexts.py (fails if a ci.yml job exists but is missing from branch-protection JSON). Port .github/scripts/check_commit_types.py (fails if commitizen schema_pattern disagrees with pr-title.yml allowed types). Wire both as CI jobs.

Acceptance criteria

• check_required_contexts.py runs in CI and exits non-zero on drift.
• check_commit_types.py runs in CI and exits non-zero on drift.
• A unit test ports from Teller's tests/test_check_commit_types.py to lock down the parsing logic.

Priority rationale

High: meta-gates are what distinguish a maintained harness from a snapshot. Without them, the harness rots.

Depends on

#9

[constk]

Merged via #47. Two new CI jobs (Branch-protection contexts sync, Commit-type sync) running green. Prerequisite files (pr-title.yml, branch-protection JSONs) landed early in this PR; #12 and #14 cover the remaining workflow/automation.