ci: run required checks for merge groups - #610

Summary

Fix missing required checks on merge-queue commits:

• Add merge_group triggers to PR lint, pre-commit, and Bash 3.2 compatibility workflows.
• Run the PR title validator only on PR events; acknowledge previously validated titles on merge groups.
• Use the merge-group base SHA for Bash relevance detection, validate the SHA, and preserve fail-closed behavior.

Refs: #607
Unblocks: #592
Related fix: GSA-TTS/agentic-coding-patterns#524

Verification

• PASS: YAML, whitespace, EOF, merge-conflict checks, and git diff --check.
• PASS: shell syntax and focused relevance tests covering malformed/missing SHAs, relevant/irrelevant paths, and fetch/diff failures.
• PASS: all 16 upstream-result gate combinations.
• PASS: adversarial AI subagent review found no blockers.
• BLOCKED locally: full pre-commit exhausted disk space while building pinned gitleaks; actionlint unavailable.
• Pending: PR CI and all three required contexts reporting on a real merge-group SHA with successful queue progression.

Security impact

Preserves required check names, read-only permissions, pinned actions, and queue-ref concurrency isolation.

Rollback

Revert this commit; doing so restores the missing merge-group checks.

AI assistance

Implemented and reviewed with OpenCode AI agents under the approved three-workflow plan. Human review remains pending.