ci: run pre-commit on pull requests, and repair the hooks it runs

[hello-alexmcc]

Follow-up to #21. While checking that PR's CI I found that only PR Title Check ran — because it is the only workflow in the repo. Digging in, the pre-commit hook set has never worked at all.

Two bugs in .pre-commit-config.yaml

1. The config has been invalid YAML since the day it was added (017ebcc, 2026-03-02 — its only commit).

branch-name-check's unquoted entry: contains ": " inside its own error message, which YAML parses as a nested mapping:

$ pre-commit run --all-files
An error has occurred: InvalidConfigError:
==> File .pre-commit-config.yaml
=====> mapping values are not allowed in this context
  in "<unicode string>", line 28, column 177

So pre-commit install and pre-commit run have always aborted, and none of the eight hooks has ever executed for anyone — not trailing-whitespace, end-of-file-fixer, check-yaml, check-merge-conflict, check-added-large-files, codespell, dco-check, nor branch-name-check. Rewritten as a folded block scalar.

2. dco-check validated the wrong commit. It ran git log -1, which at commit-msg stage is the parent commit — the one being written doesn't exist yet. It passed whenever the previous commit happened to carry a sign-off, regardless of the current one. Demonstrated before the fix:

$ pre-commit run dco-check --hook-stage commit-msg --commit-msg-filename msg_without_signoff
DCO sign-off check.......................................................Passed   # wrong

It now greps the commit-msg file pre-commit passes in ("$1") and prints an actionable hint. After the fix, that same message fails and a signed one passes.

3. codespell gains -L wit,WIT. With the config repaired, codespell fires for the first time and flags 14 occurrences of WIT/wit — the WebAssembly Interface Types format name, used throughout wasm-plugin.md, map/SKILL.md and README.md. smg's own codespell args already carry wit,WIT for exactly this reason, so this mirrors the sibling repo rather than inventing an exception.

New workflow

.github/workflows/pr-checks.yml, three jobs. pr-title-check.yml is untouched.

Job	What it does
pre-commit	pre-commit run --all-files --show-diff-on-failure, skipping the two local git-stage hooks that cannot run over a checkout. Mirrors smg's pre-commit job.
commit-messages	DCO sign-off on every commit in the PR range, plus the forbidden AI co-author/sign-off check — ported from smg's pr-naming-check.yml.
branch-name	Enforces the same prefixes branch-name-check allows. Internal PRs only; forks exempt, as in smg.

Verification

Run locally with pre-commit 4.6.2 against a repaired config:

trim trailing whitespace.................................................Passed
fix end of files.........................................................Passed
check yaml...............................................................Passed
check for merge conflicts................................................Passed
check for added large files..............................................Passed
codespell................................................................Passed

Both repaired hooks were tested in both directions: branch-name-check passes on chore/* and fails with the correct message on a bad name; dco-check passes a signed message and fails an unsigned one. The workflow's DCO loop and attribution grep were run against real commit ranges, including a deliberately unsigned commit, which the loop correctly rejected.

One thing for you to decide

There is a pre-existing mismatch this PR mirrors rather than resolves: pr-title-check.yml accepts the title type ci:, but the branch-prefix list (setup|feat|fix|docs|chore|refactor) has no ci/*. This PR is therefore on chore/pre-commit-ci with a ci: title. If you would rather allow ci/* branches, that is a one-line addition to both .pre-commit-config.yaml and the new branch-name job — say the word and I will add it.

---

Follow-up commit (9eca55d): the first CI run of this very workflow failed its own DCO job — the only "unsigned commit" it found was e6d3561 Merge e357bb5 into e119304, GitHub's generated merge commit, which actions/checkout checks out on pull_request events and which carries no sign-off. Both commit-range walks now pass --no-merges, matching the usual DCO convention of exempting merges. All four checks green after the fix.

---

Why PRs were showing no CI at all (a31c4a8)

The deeper cause of "CI never runs": the main ruleset ("PRs & conventional commits", active, no bypass actors) requires three status checks that nothing in this repo produced, so every PR sat BLOCKED waiting on contexts that would never report:

Required context	Reported by	Reality before this PR
finish	GitHub Actions	no such job existed
Conventional Commit Title	GitHub Actions	the job reported as check-title
DCO	DCO app (integration 1861)	app not enabled on this repo

All three were copied from smg, where they are real (finish at pr-test-rust.yml:1192, PR Title & Commit Messages at pr-naming-check.yml:59, plus the DCO app). The guide's copy hand-edited one name and never created matching jobs. Nobody hit it because the last merge was #20 on 2026-07-15 and the ruleset was tightened on 2026-07-31 — #21 and #22 are the first PRs since.

Fixed on the runner side rather than by weakening the ruleset:

• pr-title-check.yml — job now carries name: Conventional Commit Title, so its check run reports under the required context.
• pr-checks.yml — new aggregate finish job (needs all three PR jobs, if: always()) that fails if any failed or was cancelled. skipped is allowed, since commit-messages and branch-name do not run on push and branch-name is skipped for fork PRs.

finish and Conventional Commit Title now report and pass. DCO still needs an org owner to add this repo (1170922059) to the existing smg-project dco installation (150406607) — it cannot be satisfied from Actions, because the ruleset pins that context to integration 1861.