ci(ci): require the Validate workflows, and name every workflow for its job

[justinmerrell]

Summary

Step 3 of ADR 0036 §5, the 7c follow-up to #154.
The live main-branch ruleset already requires Validate / Required and Validate Pull Request / Required
(applied 2026-09-29), so this PR brings the repository in line with it. Nothing touches specifications/<family>/,
so no family release picks it up.

The ruleset file matches the live ruleset

• .github/rulesets/main-branch.json requires the two aggregates in place of Lint, Schema, Site Build and
  Signed off. The live ruleset and this file now agree (the RULESETS.md drift check shows only the expected
  dismissal_restriction).
• RULESETS.md, CONTRIBUTING, tools/README.md, docs/publication.md and the tool comments name the new checks and
  the jobs behind them. Accepted ADRs keep their historical wording (non-negotiable refactor: de-seed the schema $defs names, titles, and prose #11).

Legacy workflows go

• ci.yml and dco.yml are deleted. validate.yml and validate-pull-request.yml run every job they ran,
  and have done so beside them since chore(repo): adopt the engineering conventions (ADR 0036) #154.

Every workflow is named for its responsibility

Before	After	Name
lint-pr.yml	repository-pull-request-title.yml	Repository Pull Request Title
devcontainer.yml	validate-devcontainer.yml	Validate Dev Container
codeowners-notice.yml	repository-codeowners-notice.yml	Repository CODEOWNERS Notice

• check:commits reads the renamed title workflow, and the lefthook commits glob follows it.
• validate-devcontainer.yml's own paths: filter names its new filename.
• release.yml's release-please job is release_please, and every needs follows.

No step swallows a failure (GHA-41)

• CODEOWNERS notice:
  • a failed gh api call now fails the notifier, where it used to read as "nothing owned" and drop the notice;
  • git check-ignore's exit 1 (no path matched) is still an answer, but anything higher fails;
  • whitespace is trimmed with parameter expansion, not xargs || true.
• release.yml:
  • recovery counts a tag's releases with jq -s over every page, not grep -c . || true;
  • the publish step uses diff itself as the comparison, so no failure has to be discarded.

Findings left

conventions check (0.6.1) goes from 22 warnings to 1: CONF-04 on .config/spelling/musher.txt, a false
positive fixed in engineering-conventions#44 and not yet released.

Test plan

• task check passes locally, with the pinned mise and mise install --locked
• conventions check: 1 warning, 0 errors
• jq count/index and the whitespace trim exercised by hand on empty, one and many inputs
• CI green: Validate / Required and Validate Pull Request / Required
• After merging: the next pull request touching .github/CODEOWNERS-owned paths gets its notice from the renamed
  workflow; the next release recovery (if any) exercises the new count

🤖 Generated with Claude Code

[github-actions]

You own some of the paths this pull request changes

@justinmerrell, this pull request touches paths you are a code owner for. Your authorship waives the code-owner review requirement — GitHub cannot request a review from a pull request's author — so nobody is automatically notified about these changes:

• .github/CODEOWNERS — you are the sole owner; no review will be requested
• .github/rulesets/RULESETS.md — you are the sole owner; no review will be requested
• .github/rulesets/main-branch.json — you are the sole owner; no review will be requested

Double-check they are intentional. If you want a second pair of eyes, request a review manually. (Automated notice from the repository-codeowners-notice workflow — ADR 0015.)