ci: pr-title.yml installs the whole workspace to use one parser

[IgorShevchik]

Raised in review of #471 and deliberately not fixed there, since the job is correct as written and the cheaper spellings each cost something.

What it does now

.github/workflows/pr-title.yml checks a PR title against assert-commit-parses.mjs, which imports @conventional-commits/parser. To get that one package on disk the job runs:

- run: pnpm install --frozen-lockfile --ignore-scripts

That resolves the entire workspace — root, docs/, four playgrounds — for a check that reads one string. --ignore-scripts already removes the postinstall work, which is the bulk of it, and cache: pnpm makes repeat runs cheap. What remains is still a full lockfile resolution, and it runs on every opened, edited, reopened and synchronize — so an author fixing a typo in their title pays for it again.

Why the obvious fixes were not taken

• npm i --no-save @conventional-commits/parser@0.4.1. Fast, and it walks straight past assert-lockfile-frozen.py, which only guards pnpm install. Adding a documented exception to a supply-chain check to save a minute is the wrong trade, and worse, it installs a version that is not the one the lockfile pins — so the guard could disagree with ci.yml about whether a message parses.
• A marketplace action such as amannn/action-semantic-pull-request. No install at all, but it would hold a second copy of the type list, and the whole point of the check as written is that the list is read from release-please-config.json and cannot drift. It also cannot do the parse, which is what catches Revert "…" and the malformed subjects in release: test(components): … pathe … (#427) is silently missing from the 2.12.0 release notes #436.
• Folding the check into ci.yml. That job already installs. But ci.yml does not listen for edited, so a corrected title would need an empty push to re-run — which is the friction the separate job exists to remove.

What would actually work

Some way to materialise one lockfile-pinned dependency without resolving the workspace. pnpm fetch plus a filtered install, a tiny committed vendored copy with a guard that it matches the lockfile, or a prebuilt single-file bundle of the parser generated at release time. Each needs its own correctness argument, which is why this is an issue and not a line in #471.

Acceptance

• The title check no longer resolves the whole workspace.
• The version of the parser it uses is still the one pnpm-lock.yaml pins, and something fails if that stops being true.
• changelog-sections remains the single source of the type list.
• edited still re-runs the check.

Priority: P3 — this is cost, not correctness.