feat(guardrails): CC-layer content gate — commit subject + PR title

[kyle-sexton]

f4, zero-setup default enforcement. Blocking PreToolUse gate validating the commit subject AND gh pr create --title against the resolved pattern (reads the #S1 lib/ resolver).

• Parse the -F - heredoc subject; inherit block-noncanonical-commit's exemption taxonomy (--amend, -C/-c, --fixup/--squash, sequencer-in-progress) or it breaks rebases/merges.
• Never block gh pr create itself (preserves the documented inline fallback).
• Declare bypass coverage: gh pr edit --title, --fill, API, babysit retitles are out of scope.
• userConfig kill switch, default: true. Depends on #S1.

Part of #912. Contract + design in #912 — do not diverge.