ci: harden contributor checks

[cyfyifanchen]

Summary

• Add a dedicated Commit lint workflow and reusable commit-message checker for Conventional Commit subjects.
• Split CI into separate jobs for lint, unit tests, integration tests, and package build so each can be required independently.
• Add make package to build the sdist/wheel and smoke-test importing the built wheel.
• Move docs validation into reusable scripts/Makefile targets, refresh workflow action versions, and align contributor docs with protected-main PR workflow.
• Stabilize the cross-process memory-root lock unit tests so make test stays green on local Python 3.13/macOS while preserving the real POSIX lock behavior.
• Document the expected main branch protection baseline and required status checks.

Verification

python3 -m py_compile scripts/check_commit_messages.py scripts/check_docs.py
make docs-check
make check-commits
make lint
make package
make ci

Local results:

• make lint: passed
• make package: built everos-1.0.0 sdist/wheel and imported the wheel as 1.0.0
• make ci: passed, including 1178 unit tests and 57 integration tests

Remote PR checks are green:

• CI / lint
• CI / unit tests
• CI / integration tests
• CI / package build
• Docs / links
• Commit lint / commit messages

Branch protection

main is now configured with strict required status checks for the six always-emitted contexts above. Dependabot config validation is documented as optional/advisory because it is not emitted for every normal pull request.