docs(repo): record that the merged subject must be the validated one

[justinmerrell]

The setting change is already applied; this records it where a reader will find
it. This one touches .github/rulesets/, an owned path — but you own it, so
authorship waives the requirement and the notice workflow posted the sticky
comment instead. Both halves of ADR 0015 behaving as designed.

What was wrong

squash_merge_commit_title was GitHub's default, COMMIT_OR_PR_TITLE. Under
that, a pull request with exactly one commit lands that commit's subject
rather than the title Conventional PR title validated. Normalising the PR
title does nothing about Dependabot's commit message, which stays capitalised.

#67 is the proof, already on main:

validated: build(deps-dev): bump the tooling group across 1 directory with 5 updates
landed:    build(deps-dev): Bump the tooling group across 1 directory with 5 updates (#67)

ADR 0016 decision 3 was therefore true of every pull request and false of every
merge.

It was never only the bot's problem. Any single-commit pull request landed a
subject that only the local commit-msg hook had seen, and that hook checks
the type, not the case — so feat(component): Add restartPolicy would sail
through from a human too.

What changed

squash_merge_commit_title is now PR_TITLE, so the string CI validates and
the string that reaches main are the same string, for everyone.

$ gh api repos/musher-dev/spec --jq .squash_merge_commit_title
PR_TITLE

Being a repository setting rather than a ruleset field, nothing in
.github/rulesets/ can carry it — so it joins invariants 5 and 6 as one that
is only visible against live GitHub state, with the command to verify it.
ADR 0016 gains it as decision 4.

Checklist

• Commits are DCO signed off (git commit -s)
• Commit messages are Conventional and correctly scoped
• task ci:lint passes locally
• No specification prose, schema, or conformance fixture is touched

[github-actions]

You own some of the paths this pull request changes

@justinmerrell, this pull request touches paths you are a code owner for. Your authorship waives the code-owner review requirement — GitHub cannot request a review from a pull request's author — so nobody is automatically notified about these changes:

• .github/rulesets/RULESETS.md — you are the sole owner; no review will be requested

Double-check they are intentional. If you want a second pair of eyes, request a review manually. (Automated notice from the codeowners-notice workflow — ADR 0015.)