build(git-hooks): enforce Conventional Commits via a hook + CI, record history decision

The convention was documented in CONTRIBUTING.md but nothing enforced it, and no
decision was on record for the pre-self-hosting `Phase` history.

- tools/git-hooks/commit-msg — rejects a summary that is not a Conventional
  Commit. tools/git-hooks/lib.sh holds the single rule (types, scope, `!`, and
  the merge/revert/autosquash exemptions) so the hook and CI cannot drift.
- tools/git-hooks/lint-range.sh — lints a commit range with that same rule.
- .forgejo/workflows/commit-lint.yml — runs it over the new commits on every
  push and PR, as the backstop for contributors who have not enabled the hook.
- Fix the pre-commit hook, which pointed at the old build/ludic-fmt path (the
  toolchain moved to bin/) and so silently no-op'd; it now finds bin/ludic-fmt.
- CONTRIBUTING.md — full type/scope table, the one-line enable
  (`git config core.hooksPath tools/git-hooks`), and a **Git history** section
  recording the decision: leave the pushed `Phase`-era history as-is (a rewrite
  is destructive and non-reversible for anyone who cloned); enforce the
  convention going forward; let #33's first release tag double as the clean `v0`
  baseline that brackets the old prefix without touching a commit.

Verified: the hook accepts feat/fix/ci/refactor(!)/merge/revert and rejects
"added regex" / "Fix bug" / "WIP"; lint-range passes recent history and flags
the old `Phase 8b:` commit.

Closes #34

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tools/git-hooks/lint-range.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+# Lint every commit summary in a git range against the Conventional Commits rule.
+# Used by the commit-lint CI job; usable by hand too:
+#
+#   tools/git-hooks/lint-range.sh origin/main..HEAD
+#
+# With no argument it lints just the tip commit. Reports every commit, then exits
+# non-zero if any failed.
+set -e
+RANGE="${1:-HEAD~1..HEAD}"
+
+. "$(dirname "$0")/lib.sh"
+
+# Collect subjects into a file so the loop runs in this shell (a pipe would put
+# it in a subshell and lose the verdict). Merge commits are exempt by the rule
+# and skipped here so a merge subject never trips the lint.
+tmp=$(mktemp)
+git log --no-merges --format='%s' "$RANGE" > "$tmp"
+
+fail=0
+while IFS= read -r subject; do
+  [ -n "$subject" ] || continue
+  if conventional_ok "$subject"; then
+    echo "  ok    $subject"
+  else
+    echo "  FAIL  $subject"
+    conventional_help "$subject"
+    fail=1
+  fi
+done < "$tmp"
+rm -f "$tmp"
+
+[ "$fail" -eq 0 ]