ci: standardise pre-commit, lint and release tooling

[av-dev2]

The automatic backport of #130 to version-16-hotfix could not cherry-pick,
because that pull request contains a repository-wide reformat. This branch
applies the same standard to version-16-hotfix directly instead.

Hooks now run at three stages

Stage	Scope	Behaviour
pre-commit	staged files	fast, autofixes, blocks the commit
commit-msg	the message	conventional prefix, blocks the commit
pre-push	whole repository	blocks the push on any failure

Run bash scripts/setup-git-hooks.sh once per clone. Git cannot force hooks
onto a fresh clone, so the Pre-commit workflow running --all-files on every
pull request is the real gate.

Removed

ci.yml, release.yml and .releaserc.json.
tag-and-promote-from-pr-label.yml is now the only owner of tags, releases and
promotion.

Defects fixed along the way

• stock_entry was assigned on self inside on_submit, after Frappe had
  written the row, so the link field stayed empty. Now uses db_set.
• .orderby(sd.salary_component, Order.asc) passed the direction positionally,
  so pypika read it as a second ORDER BY column. Five queries.
• get_value on a Single doctype is not type safe; now get_single_value.
• send_email == True compared a Frappe checkbox against True. Frappe returns
  the integer 1, so this is now a truthiness test.
• A bare except around json.loads now catches ValueError.

Semgrep waivers

Five findings reviewed and waived, each naming the rule and the reason in the
code: frappe-ssti (hardcoded template path, static template),
frappe-codeinjection-eval (Script Report python needs real imports, so
safe_exec is not usable; editing a Report is restricted to System Manager) and
frappe-breaks-multitenancy on three query builder tables in one report.

The frappe-codeinjection-eval waiver documents the risk rather than removing
it. Revisit if Report write access is ever widened beyond System Manager.

pre-commit run --all-files passes on this branch.