ci(conventions): Extract conventional validation into a shared action

[LMLiam]

Problem

The trusted-base bootstrap in .github/workflows/pr.yml duplicates conventional-subject validation and is difficult to maintain. https://github.com/lmliam/kotventure should be updated to also consume this now-shared action.

Proposed implementation

• Create a public LMLiam/actions repository.
• Add a conventional-subject composite action with black-box tests for accepted and rejected subjects.
• Preserve the verb(area): description convention and trailing-full-stop rejection.
• Give the action no permissions and do not execute untrusted repository scripts.
• Publish a stable release and pin consumers to the full release commit SHA.
• Configure Dependabot to propose action updates.
• Replace the bootstrap validator in clamshellctl.
• Replace the duplicated validator in Kotventure in a separate pull request.
• Document the action inputs, outputs, versioning, and security model.

Acceptance criteria

• Both repositories use the same tested implementation.
• Pull-request titles and commit subjects retain their current validation behaviour.
• Consumer workflows remain safe for forked pull requests.
• Workflow lint and repository test suites pass in both consumers.

Related issues

• Kotventure #342 tracks the Kotventure consumer migration.

Raised from PR #11 review: #11 (comment)