chore: validate commit scope in commit-msg hook

cog verify in cocogitto 6.x does not validate the scope component of
a conventional commit header against the configured `scopes` list
(cocogitto/cocogitto#516). Fixed upstream in v7.0.0 by
cocogitto/cocogitto#541, but mmdflux can't move to v7 yet because of
the open cocogitto/cocogitto#558 monorepo bump_order regression.

Add an inline shell check to [git_hooks.commit-msg] that extracts the
scope from the header (handling the optional breaking-change `!`
marker) and rejects anything not in the cog.toml scopes list.
Single-line `scopes = [...]` parsing via awk; multi-line arrays would
need a real TOML parser. Unscoped commits (root crate, per the
project convention) continue to pass through.

This avoids the round-trip cost of pushing a commit with an
unrecognized scope and only finding out in CI. The block is tagged
with the upstream issue references so the next person knows to drop
it once both upstream changes are shippable.

Contributors re-running `just setup-hooks` from the main repo will
pick up the new hook automatically.

Author: kevinswiber

cog.toml

@@ -50,6 +50,26 @@ if echo "$header" | grep -q '\.$'; then
     echo "error: commit subject must not end with a period"
     exit 1
 fi
+
+# Workaround for cocogitto/cocogitto#516: `cog verify` does not validate
+# scope against the configured `scopes` list. Fixed upstream in v7.0.0 via
+# cocogitto/cocogitto#541. Remove this block once mmdflux is on cog >= 7
+# (currently blocked on cocogitto/cocogitto#558). Single-line `scopes = [...]`
+# assumed; multi-line arrays would need a real TOML parser.
+scope=$(echo "$header" | sed -nE 's/^[a-z]+\(([^)]+)\)!?:.*/\1/p')
+if [ -n "$scope" ]; then
+    allowed=$(awk -F'=' '/^scopes[[:space:]]*=/ {
+        sub(/^.*=[[:space:]]*\[/, "")
+        sub(/\].*$/, "")
+        gsub(/[" ]/, "")
+        print
+    }' cog.toml)
+    if ! echo "$allowed" | tr ',' '\n' | grep -qx "$scope"; then
+        echo "error: scope '$scope' is not in cog.toml scopes list"
+        echo "  allowed: $allowed"
+        exit 1
+    fi
+fi
 '''
 
 [git_hooks.pre-push]