feat: extend pr-hygiene with pr-title and stale options

[rldyourmnd]

Summary

Extends pr-hygiene.yml with six new optional inputs. All default to the prior
behaviour, so existing callers are unaffected.

pr-title job (amannn/action-semantic-pull-request):

• pr_title_types (string, default '') — comma-separated allowed
  conventional-commit types. Empty keeps the action's Conventional Commits
  defaults.
• pr_title_require_scope (boolean, default false) — passed to requireScope:.
• pr_title_subject_pattern (string, default '') — regex constraining the PR
  title subject. Empty applies no extra subject validation.

stale job (actions/stale):

• stale_operations_per_run (number, default 30) — operations-per-run:.
• stale_exempt_issue_labels (string, default '') — exempt-issue-labels:.
• stale_exempt_pr_labels (string, default '') — exempt-pr-labels:.

The action's types: input is newline-delimited, but the workflow input is
comma-separated for ergonomics. A small Normalize PR-title options step
converts commas to newlines (via env, no ${{ inputs }} interpolation in
run:) and trims empties, leaving the output empty when no types are supplied
so the action falls back to its defaults.

Type of change

• Fix / extension to an existing workflow

Threat-model note

No new third-party action is introduced and no permission scope changes. The new
inputs only configure already-pinned, already-permissioned actions. The
normalize step runs a fixed pipeline over a caller-supplied string with
set -euo pipefail; it cannot execute caller input (no eval/bash -c).

Permissions diff

No change. pr-title keeps contents: read + pull-requests: read; stale
keeps contents: read + issues: write + pull-requests: write.

Checklist

• Third-party actions pinned to full 40-char SHA + # vX.Y.Z comment.
• Least-privilege permissions (unchanged).
• timeout-minutes present on both jobs (unchanged, via timeout_minutes).
• persist-credentials: false on read-only checkouts (unchanged).
• No ${{ inputs.* }} inside run: — values pass through env:.
• catalog/capabilities.yml updated (risk note + last_verified).
• docs/generated/* regenerated (no matrix drift).
• CHANGELOG.md updated under [Unreleased] -> ### Added.
• Commits signed (-S) and signed off (-s).

Validation note

python3 scripts/validate_all.py reports two pre-existing failures on main
that are unrelated to this change: pinned-actions (caller-supplied SHA
pins in clusterfuzzlite.yml/rust-supply-chain.yml) and catalog
(clusterfuzzlite-fuzzing uses the non-enum cluster testing-quality). Both
were introduced by PRs #68/#69 and exist on origin/main. Every check touching
this workflow (workflow-contracts, permissions, examples,
generated-docs, runtime-coverage) is OK and this PR adds no new failures.