refactor(commit-lint): use compare API and bump header to 100

[igor-raits]

Summary

Modernizes the commit-lint workflow with three main changes:

• Drop the unused JS variant. commit-lint.yaml (wagoid-based) hasn't received any updates in ~1 year; all activity has been on the shell variant. Both ran on every PR with the same name, doing duplicate work. The shell version is renamed back to commit-lint.yaml.
• Replace actions/checkout + git log with gh api .../compare. The previous setup did fetch-depth: 100, which silently breaks on PRs with >100 commits or on merge_group events where the base diverged further back. Bumping to fetch-depth: 0 would fix correctness but full-clone large consumer repos (gdc-nas, gooddata-ui-sdk, etc.) on every PR. The compare API returns exactly the commits we need with no checkout at all.
• Bump header max length 70 → 100. Matches the modern commitlint default and Angular's choice; 70 was unusually tight after the Conventional Commits prefix overhead.

Other audit fixes folded in

• Unified renovate/extimage bot-bump skip pattern. Previously the length check skipped only chore: bump, while the risk check skipped only chore...: Update — inconsistent. Now both checks share one regex matching chore(\(deps\))?: (Update|update|bump) ….
• GitHub context passed via env: instead of inline ${{ … }} interpolation (actionlint hygiene; removes a script-injection foot-gun if reused with less-trusted fields).
• set -euo pipefail so silent failures (e.g., a malformed git interpret-trailers invocation) surface instead of producing empty trailers and passing.
• Replaced echo | awk / echo | cut subshells with bash parameter expansion.
• Permissions narrowed to contents: read (was contents: read + pull-requests: read; the latter was for wagoid).
• Single step instead of two — set_commit_range dropped; SHAs come from job-level env using the || fallback (works for both pull_request and merge_group).

Test plan

• Verify gh and jq are available on infra1-runners-arc runners (standard on GitHub-hosted; needs confirmation for ARC)
• CI for this PR runs against the new workflow (workflow modifications in pull_request use the head ref) — a green check here exercises the happy path
• Manually verify against a chore(deps): update … renovate-style commit (skip path)
• Manually verify against a long feat(scope): … commit between 70 and 100 chars (should now pass)
• Verify the risk-trailer path still fires by testing on a fork of gdc-nas / gdc-ui (out of scope for this repo's CI)

🤖 Generated with Claude Code