ci: add PR size and title checks, configure commitizen

[greysonlalonde]

Summary

• Add pr-size.yml workflow that auto-labels PRs by size and blocks merging PRs over 500 lines
• Add pr-title.yml workflow that enforces conventional commit format on PR titles
• Configure commitizen in pyproject.toml with strict schema pattern for conventional commits

Details

These enforce the conventions defined in RELEASE_PROCESS.md:

• PR size: XS/S/M/L/XL labels applied automatically. XL fails CI. Excludes lock files, CLI templates, JSON, test duration caches, and VCR cassettes from the count.
• PR title: Must match <type>(<scope>): <description> with allowed types: feat, fix, refactor, perf, test, docs, chore, ci, style, revert. Lowercase description, no trailing period.
• Commitizen: Configured with the same type and pattern rules for local pre-commit enforcement.

Both pr-size and pr-title should be added as required status checks on main once they run for the first time.

Test plan

• Open a PR with a non-conventional title and verify pr-title check fails
• Open a PR over 500 lines and verify pr-size check fails and labels as size/XL
• Verify commitizen rejects non-conforming local commits

To fix the problem, explicitly declare a minimal permissions block in the workflow so that the GITHUB_TOKEN has only the rights needed. This job reads pull request information to validate the title and does not need to write to the repo, so contents: read and pull-requests: read are sufficient and follow the principle of least privilege.

The best fix without changing existing functionality is to add a permissions section at the workflow root (top level), so it applies to all jobs, right below the name: or on: block. Concretely, edit .github/workflows/pr-title.yml to insert:

permissions:
  contents: read
  pull-requests: read

between the on: block (ending at line 5) and the jobs: block (line 7), or directly after name: if you prefer. No imports or other definitions are needed; GitHub Actions interprets this permissions key natively.