Adds .github/workflows/lint-pr.yaml with two checks:

1. Conventional Commits: validates the PR title using
   amannn/action-semantic-pull-request (matches the pattern used in
   scale-agentex and agentex). Bypassable via the
   skip-conventional-commit-check label for automation that needs it.

2. PR base validation: fails on PRs targeting main, with exemptions
   for known automation accounts (stainless-app, release-please,
   github-actions, dependabot) and an opt-out via the target-main
   label. Encourages developer PRs to target next, where Stainless
   codegen and release-please integrate, while keeping main
   accessible for hotfixes.

The Stainless TS/Python repos restrict GitHub Actions to an allowlist
that doesn't include amannn/action-semantic-pull-request. Using a
pure-shell regex check keeps the workflow self-contained and removes
the third-party dependency, which also reduces supply-chain risk.

…tion

GitHub Actions only processes workflow commands (::error, ::warning,
etc.) when they appear on stdout. The previous code wrote the ::error
line inside a {...} >&2 block, sending it to stderr — the job still
exited 1, but the red annotation linking back to the failing PR title
never appeared in the Actions UI. Move the ::error to stdout and keep
the long-form details on stderr.

Caught by Greptile review on the sgp-typescript PR; applied to all 4
repos for consistency since the same pattern existed in each.

…te lookup

Three fixes from review feedback, all in lint-pr.yaml:

1. Exempt automation accounts from validate-pr-title. Bots like dependabot
   create PRs with non-Conventional-Commits titles by default
   ("Bump foo from 1.0 to 1.1"), and we don't want them blocked. The
   exemption list mirrors validate-pr-base for consistency.

2. Make gh-CLI write failures non-fatal in validate-pr-base. Previously,
   if `gh pr comment` or `gh api -X PATCH` failed (fork PR token without
   upstream write scope, transient API error, rate limit), `set -e`
   would abort the script and the ::error annotation + exit 1 never
   ran. Now each write is guarded so the failure annotation always
   reaches the contributor, and a ::warning explains when the comment
   itself couldn't be written.

3. Use --paginate when looking up the marker comment. The default page
   size is 30, so on busy PRs the marker could be missed and a duplicate
   "PR should target next" comment posted on every workflow re-run.

Verified locally with a 28-case bash harness covering all branches:
valid/invalid title formats, bot-account variants (including
stainless-appx near-misses that should NOT be exempted), no-comment vs
existing-comment paths for the base check, and all gh-call failure
modes — every case behaves as expected.