feat: Configure draft pull request scanning across trigger modes

[julio-rocketchat]

Summary

• Add trigger.scanOnDraft with global and repository overrides.
• Handle ready_for_review events.
• Check live draft state before scans deferred to workflow_run/workflow_job.

Breaking default and migration

Draft PRs are skipped by default. Set trigger.scanOnDraft: true to preserve draft scanning. Deferred workflows must subscribe to ready_for_review to start their gate when a PR becomes ready. A major changeset records this default change.

Verification

• Node 22: build, typecheck, lint, config validation, all 633 tests passed.
• Regression tests cover draft/ready transitions, both deferred trigger modes, opt-in scanning, inheritance, and invalid config values.
• Security review checked signature verification, live-state gating, queue admission and boolean validation. Gitleaks staged-patch scan passed.
• Only this feature was extracted; the public configuration remains the baseline.

[julio-rocketchat]

CI follow-up: the shared install failure was reproduced in an isolated Node 22 container. With maintainer approval, this branch now uses npm ci instead of deleting the lockfile and resolving a fresh dependency graph. This is the only CI change; GitHub checks are rerunning.