Validate the draft's frontmatter and title from agentrepo pr #911

Problem

validate-description.sh is 553 lines and the largest pull request script. Its first half judges the draft's frontmatter (keys, sequences, booleans, labels, a base that names no branch) and the title (Conventional Commits shape, bounds, a type unused among the commits that would land, a trailing pull request number). It is the gate behind mise run lint-pr-description, and it cannot be ported in one pull request without breaching the size limit.

Part of #588 and #323. Delivers in Go the behavior of the frontmatter and title rules of packages/agents/source/skills/pr/shared/scripts/validate-description.sh. This change adds Go behavior only and switches no caller, so the shell validator keeps running every rule until children 03 and 12 land.

Acceptance criteria

1. AC1: Given a draft with a missing, unterminated, duplicated-key, unknown-key, non-sequence, non-boolean or empty-base frontmatter, when it is validated, then each problem is reported on its line with the same rule name and fix text as the shell.
2. AC2: Given a frontmatter that sets no base, draft or labels, when it is validated, then frontmatter-missing-key is reported at the opening fence.
3. AC3: Given empty labels ([] or [ ]), when it is validated, then labels-empty is reported on the labels line.
4. AC4: Given a labels list that includes the repository's configured owner-review label, in any letter case, when it is validated, then owner-review-label is reported on the labels line; given a list without it, including a golden-path change, then no such finding is made.
5. AC5: Given a base that names no local or origin branch, or the branch the pull request comes from, when it is validated, then base-unknown or base-is-head is reported, and the base resolves to origin/<base> where origin has one, else the local branch.
6. AC6: Given a title that is missing, repeated, ends in a period, or whose length is under 10 or over 80 characters (or under PR_TITLE_MIN_LENGTH or over PR_TITLE_MAX_LENGTH when set), when it is validated, then title-missing, title-repeated, title-trailing-period, title-too-short or title-too-long is reported on the title line.
7. AC7: Given a title that ends in a parenthesised pull request number such as (#123), when it is validated, then title-carries-number is reported; given a title with other digits, such as fix: bump to v2, then it is not.
8. AC8: Given a title whose type does not appear among the commits that would land, or that is not Conventional Commits shaped, when it is validated, then title-type-unused or title-not-conventional is reported.
9. AC9: Given any fixture draft, when the Go rules for this child run, then the findings and line numbers are byte-identical to the shell validator's findings for the same rules on the same draft, and drafts with no finding in these rules print nothing.
10. AC10: Non-functional: findings keep the line-and-fix shape, rules run in the LC_ALL=C collation the shell pins, and the run makes no network connection.

Scope and non-goals

Scope: the frontmatter and title rules above.

Non-goal: the section, comment, fence, link, compatibility and backticked-path rules, which child 03 ports. Non-goal: vale and cspell, which stay in the lint-pr-description task. Non-goal: renaming or adding a rule. Non-goal: switching the shell validator to the Go behavior, which child 12 does, so the shell's complete public validation behavior is preserved meanwhile.

Approach

Meet AC1 to AC10 with failing table-driven cases first. Capture the shell validator's output on every draft fixture in the Bats suite before porting, and compare only the findings these rules produce. The package layout is the implementer's choice within those outcomes.

Dependencies

Blocked by: #910, #753.

Prerequisites: the repository configuration reader delivered under #321, and #753 for the protection of new Go enforcement paths.

Size

M. One pull request. The rule group is about 250 shell lines; with table tests and fixtures it is estimated under 600 changed code lines, and no generated or deployed file changes because no caller is switched.

Verify plan

• AC1, AC2, AC3, AC4, AC5, AC6, AC7, AC8: Go tests, one table row per rule, with a scratch repository for the base and commit-type cases and a configured owner-review label in mixed case.
• AC9: a parity test runs the shell validator and the Go rules over every fixture draft, filters the shell output to this child's rule names, and compares bytes.
• AC10: a test asserts the finding line format and that no network connection is attempted.
• Go tests run in the existing Go CI on macOS, Linux and Windows.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

A finding that changes shape breaks the published interface that mise run lint-pr-description and the writers read. The byte-identical parity test is the control. Undo: revert the change; nothing calls the Go rules yet and the shell validator runs alone.

Operator authority

None.