fix(governance): align PR types with canonical labels

[Malakof]

Summary

• define one total, canonical mapping from Conventional Commit PR types and issue-title types to the functional type taxonomy
• make strict label validation and the qualitative format precheck consume the same fail-closed policy
• share the corrected Conventional Commits grammar, including scope-before-bang breaking syntax
• add repository self-CI and regression coverage, then move every shared checkout action to the Node 24 v5 major
• prepare governance release v1.4.0

Root cause

The v1.3.2 strict workflow first required a valid Conventional Commit PR title such as fix, then converted that type literally to type:fix. The canonical taxonomy contains type:bug instead, so a correctly titled and labeled bug PR could never pass. The qualitative precheck duplicated the same broken mapping. Shared workflows also retained checkout v4 and emitted Node 20 and punycode deprecation warnings.

Acceptance criteria

• fix titles with type:bug pass both deterministic validators
• all 11 allowed PR types and all governed issue-title types have exactly one canonical label
• missing or non-canonical mapping entries fail closed
• strict and qualitative consumers cannot drift
• Conventional breaking syntax uses feat(scope)! rather than feat!(scope)
• shared workflows contain no checkout v4 or setup-python v5 pin
• the repository runs its own tests on pull requests and main

Out of scope

• weakening required labels or Conventional Commits
• accepting multiple labels for one title type
• suppressing warnings with environment variables
• modifying product code, retries, selectors, or timeouts
• crystal-platform#332

Validation

• python3 -m py_compile scripts/*.py
• python3 -m unittest discover -s tests -v — 9 passed
• validate_title.py against crystal-capabilities#7 — pass
• validate_labels.py against crystal-capabilities#7 — priority:p0 and type:bug pass
• git diff --check

Adversarial review

Claude Fable 5 at xhigh identified the issue-title compatibility domain, the non-spec bang position, the missing self-CI, and the need for a complete codomain check. Those findings are adopted. Its suggested v1.1.0 tag was rejected because live tags already reach v1.3.2; this delivery targets v1.4.0. actionlint was not added because it is unavailable locally and is not needed to prove this root cause; the new pin regression and hosted workflow provide the relevant evidence.

Refs Malakof/crystal-platform#409.
Blocks Malakof/crystal-capabilities#7.