fix(ci): commit-lint trailer guard fails open on large commit messages

[ss-o]

Summary

.github/workflows/commit-lint.yml here carries the same fail-open reported in
z-shell/.github#587. The
Validate Commits job matches the disallowed trailer as a pipeline under
set -o pipefail:

git show -s --format='%B' "$sha" | grep -qiE "$DISALLOWED_TRAILER_PATTERN"

grep -q exits on its first match. For a commit message larger than the pipe
buffer, git is still writing, takes SIGPIPE, and returns 141. pipefail
promotes that to the pipeline result, so the if reads a real match as no
match and the banned trailer passes.

Evidence

Four real commits evaluated under both constructs:

Commit message	grep -q	grep -c
Small, bot trailer	FLAGGED	FLAGGED
3 MB, bot trailer	clean	FLAGGED
3 MB, human Co-authored-by	clean	clean
3 MB, no trailer	clean	clean

Only the second row changes, which is the defect.

Fix

Use grep -c with a numeric test. grep -c reads to the end of its input, so
the writer always finishes and no SIGPIPE arises, and it keeps grep's own ERE
engine and -i semantics rather than swapping in bash [[ =~ ]] matching.

Applied to the organization copy in z-shell/.github#596.

Why it matters here

This repository is one of the two AGENTS.md names as enforcing the bot and
AI-agent Co-authored-by ban in CI. A guard that fails open is the same class
of problem as z-shell/.github#575, where the enforcement existed but never
actually ran.

[ss-o]

Resolved by #487, squash-merged to next as 40d8d5e7.

The trailer check now uses grep -c with a numeric test instead of grep -q, so the writer always reaches the end of its input and no SIGPIPE turns a real match into a miss.

Closing manually: this repository's default branch is main and the pull request merged to next, so GitHub does not act on the Closes keyword. That gap is tracked in z-shell/.github#523. The change reaches main at the next promotion.

Organization copy: z-shell/.github#596.