chore: align the hooks, PR template, CODEOWNERS and commitlint with the repo

- The pre-push hook skipped on PIPE_SKIP_PREPUSH_CI_GATE while the gate
  script it runs skipped on PIPE_SKIP_PREPUSH_GATE, so each name worked in only
  one place. Both now use PIPE_SKIP_PREPUSH_GATE.
- The PR template asked for a hand-written CHANGELOG entry; release-please
  generates CHANGELOG.md from commit subjects, so the item now says that. It
  also asked for a "Stability note" the repo does not have; removed.
- CODEOWNERS listed /docs/**, which does not exist.
- commitlint accepted `merge` but rejected `security`, a type
  release-please-config.json maps to its Security section; `security` is now
  allowed.

.githooks/pre-push

@@ -11,8 +11,11 @@ while IFS= read -r git_env_name; do
 done <<< "$git_local_env"
 unset git_local_env git_env_name
 
-if [ "${PIPE_SKIP_PREPUSH_CI_GATE:-0}" != "1" ]; then
+# One skip variable, PIPE_SKIP_PREPUSH_GATE, shared with the gate script. The
+# hook used to check PIPE_SKIP_PREPUSH_CI_GATE while the script checked
+# PIPE_SKIP_PREPUSH_GATE, so each documented name worked in only one place.
+if [ "${PIPE_SKIP_PREPUSH_GATE:-0}" != "1" ]; then
   "$REPO_ROOT/scripts/pre-push-ci-gate.sh"
 else
-  echo "[pre-push] PIPE_SKIP_PREPUSH_CI_GATE=1; skipping local CI gate" >&2
+  echo "[pre-push] PIPE_SKIP_PREPUSH_GATE=1; skipping local CI gate" >&2
 fi

.github/CODEOWNERS

@@ -6,6 +6,5 @@
 /tool/** @trvon
 /bin/** @trvon
 /test/** @trvon
-/docs/** @trvon
 /.github/** @trvon
 /scripts/** @trvon

.github/PULL_REQUEST_TEMPLATE.md

@@ -23,9 +23,10 @@
 - [ ] Recall manifest still passes (`pipe recall --root <dir> --strict`)
 
 ## Documentation
-- [ ] CHANGELOG updated (user-visible changes)
+- [ ] CHANGELOG entry: automated — release-please builds it from the
-- [ ] README updated (rules table / precision numbers)
+      Conventional Commit subjects, so check those read well; do not edit
-- [ ] Stability note updated (if interfaces change)
+      CHANGELOG.md by hand
+- [ ] README updated (rules table / precision numbers / flags and output)
 
 ## AI usage
 - [ ] No AI used

commitlint.config.js

@@ -8,6 +8,7 @@ module.exports = {
       [
         'feat',     // New feature
         'fix',      // Bug fix
+        'security', // Security fix (release-please "Security" section)
         'perf',     // Performance improvement
         'docs',     // Documentation
         'chore',    // Maintenance (deps, CI config, etc.)