Enforce Change-Id and vanity commit hash

[jserv]

This adds commit-log validation (check-commitlog.sh) that ensures every non-merge commit after 4a46a13 carries a Change-Id and meets subject line formatting rules. For commits after 5aa6396, the SHA-1 must start with "0000".

The vanity hash rewriter (vanity-hash.py) uses partial SHA-1 caching via hashlib.copy() with minimal space/tab padding (16 byte, 1 bit per byte). Each brute-force attempt hashes only the final block -- ~4096 expected attempts for a 12-bit prefix, sub-millisecond on any CPU.

Change-Id: Iadd4b0f9e8c7d6a5b3f2e1d0c9b8a7f6e5d4c3b2

---

Summary by cubic

Enforces commit hygiene across hooks and CI: every non-merge commit must include a Change-Id, follow subject rules, and (for newer commits) use a vanity SHA-1 prefix "0000". Adds fast, automatic hash rewriting and blocks non-compliant pushes/PRs.

• New Features

  • scripts/check-commitlog.sh validates non-merge commits since the enforcement point: requires Change-Id, capitalized subject (no trailing dot, sane length), warns on WIP, and flags GitHub web-UI bypass; enforces SHA-1 prefix "0000" for newer commits; supports --range for PR/push checks.
  • scripts/vanity-hash.py rewrites HEAD to match a hex prefix (default "0000") with fast SHA-1 caching; prefix configurable via git config kbox.vanity-prefix; supports --prefix and --dry-run.
  • Hooks/CI: scripts/pre-push.hook validates only the commits being pushed (handles new branches); scripts/post-commit.hook auto-applies the vanity prefix and skips CI; new CI job runs commit checks on PRs/pushes; added make check-commitlog; .gitignore now ignores __pycache__.

• Migration

  • Run make install-hooks. If validation fails, amend/rebase to add a Change-Id and fix the subject; the vanity rewrite runs automatically after commit or via python3 scripts/vanity-hash.py. Avoid --no-verify and creating commits in the GitHub web UI.

^{Written for commit 000013d. Summary will update on new commits.}