feat: Initial clean release of CHM

.github/workflows/check-pr-title.yml

@@ -0,0 +1,31 @@
+name: Check pull request title
+on:
+  pull_request_target:
+    types: [opened, edited, reopened, synchronize]
+
+jobs:
+  main:
+    # Skip the check entirely for these automation accounts.
+    if: github.event.pull_request.user.login != 'renovate[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: write
+    steps:
+      # Sparse checkout so we only pull the script, not the full repo.
+      # `pull_request_target` checks out the base branch by default,
+      # which is what we want — we never execute PR-supplied code.
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: .github/scripts
+          sparse-checkout-cone-mode: false
+
+      - name: Check title
+        uses: actions/github-script@v9
+        env:
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        with:
+          script: |
+            const check = require('./.github/scripts/check_pr_title.js');
+            await check({ github, context, core });