ci: per-commit fast-check gate (catch broken intermediate commits under rebase-merge)

[vringar]

Rebase-and-merge lands every PR commit on master individually, but CI only
tests the tip, so a commit that is broken on its own can still ship. This runs
the fast checks on each commit in the range: pre-commit run --all-files, the
commit-msg hooks, import openwpm, pytest --collect-only, plus npm ci /
npm run build if it touched Extension/ and ./install.sh if it changed
environment.yaml. No browser suite — that stays on the tip and the merge
queue.

The logic is in scripts/per_commit_checks.py rather than inline in the YAML,
so it can be linted and run locally:

python scripts/per_commit_checks.py --base master --head HEAD

It reads the range from the event payload, so nothing event-controlled reaches
a command line. Every commit is visited and every failure reported before the
non-zero exit. A failed conda rebuild is the exception and ends the walk, since
install.sh removes the env before re-creating it.

Only gates once it's a required status check in branch protection.

First commit: the commitlint hook was dead

It never linted anything. commitlint.config.js extends
@commitlint/config-conventional, a root package.json devDependency that
nothing installs in CI (MODULE_NOT_FOUND); and for anyone who has run root
npm install, rev: v9.11.0 bundles commitlint 18 against config-conventional
21, which loads no rules. Bumped to v9.26.0 with the preset as an
additional_dependency.

Consequence: release: vX.Y.Z is rejected, release not being a conventional
type. Not from the bump — it fails identically under 18. 5 of the last 40
master messages would fail, 4 of them release:. Release checklist now says
chore(release):.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.34%. Comparing base (14745c4) to head (f0c19f8).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1190   +/-   ##
=======================================
  Coverage   62.34%   62.34%           
=======================================
  Files          40       40           
  Lines        3930     3930           
=======================================
  Hits         2450     2450           
  Misses       1480     1480           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds a new GitHub Actions workflow to gate rebase-and-merge PRs by running a fast static-check suite on every individual commit in the PR (and in merge-queue merge_group candidates), preventing “broken intermediate commits” from landing on master.

Changes:

• Introduces per-commit-checks.yaml, triggered on pull_request and merge_group.
• Computes a commit range and iterates commit-by-commit, running pre-commit (changed-files), conditional Extension build, import openwpm, and pytest --collect-only.
• Aggregates failures across commits (doesn’t stop at first failure) and fails the job at the end if any commit failed.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.