ci: rework workflow for Gitea Actions (M0.2)

The original ci.yaml used wagoid/commitlint-github-action and
gitleaks/gitleaks-action, both of which hit GitHub-specific API
endpoints that 404 on Gitea ("error trying to get list of pull
request's commits: not found").

Changes:
- commitlint: bash regex against Conventional Commits, scoped to the
  PR commit range. Zero external deps.
- gitleaks: inline tarball download + binary run, exit-code 1 on
  any finding.
- trivy: unchanged (works fine; uses local fs scan).
- Per-stack test/image/e2e jobs now gated on hashFiles(go.sum) /
  hashFiles(package.json) / hashFiles(Dockerfile) so they skip
  cleanly on empty repos and light up automatically when real code
  lands (M4.1, M5.1, etc.).

Refs: M0.2

CHANGELOG.md

@@ -12,6 +12,7 @@ Generated section is appended on release tag via `git-cliff` (see `.gitea/workfl
 -
 
 ### Fixed
+- ci: rework workflow for Gitea Actions (bash commitlint, inline gitleaks binary, per-stack jobs gated on real code)
 -
 
 ### Removed