fix(ci): normalise a bot's PR title in the job that judges it

[justinmerrell]

Follow-up to #65. The normaliser it added was a workflow of its own, on the
assumption that its retitle would re-run the title check. That assumption is
wrong, and the two recreated Dependabot pull requests showed it within minutes.

A retitle made with GITHUB_TOKEN does not trigger a new workflow run.
GitHub suppresses that to prevent loops. So the separate normaliser corrected
the title and left Conventional PR title sitting on the red it had produced
before the edit — a failing check against a title that is now perfectly
valid, with nothing scheduled to look again.

• build(deps-dev): bump wrangler from 4.124.0 to 4.125.0 in /tools #66 stayed red with a correct title until I re-ran the check by hand.
• build(deps): bump ghcr.io/devcontainers/features/github-cli from 1.1.0 to 1.1.1 #60 went green, but only because Dependabot pushed again a minute later.
  Luck, not design.

The fix

Move the step into the Conventional PR title job, ahead of the action, and
delete the separate workflow. There is no second event to depend on.

This works because amannn/action-semantic-pull-request re-reads the title
from the REST API rather than trusting the event payload — deliberately, and
for exactly this reason:

The pull request info on the context isn't up to date. When the user updates
the title and re-runs the workflow, it would be outdated. Therefore fetch the
pull request via the REST API to ensure we use the current title.

Confirmed empirically before writing this: re-running the stale failed run on
#66, with its original payload, passed.

Cost

lint-pr.yml goes from pull-requests: read to write. It runs on
pull_request_target, so what makes that safe is that it has no checkout step
and takes every pull-request value through env: rather than a ${{ }}
expansion inside run:. Both were already true; both are now stated in the
file so they survive editing.

ADR 0016 §3 is corrected to describe what actually works, and the rejected
separate-workflow design is recorded under Alternatives so it is not tried
again.

Checklist

• Commits are DCO signed off (git commit -s)
• Commit messages are Conventional and correctly scoped
• task ci:lint passes locally
• No specification prose, schema, or conformance fixture is touched