chore(lastlight): skip the weekly security scan

[robinbowes]

Adds .lastlight/lastlight.yml opting this repo out of Last Light's weekly-security-scan cron.

Why

This is a fork of wagoid/commitlint-github-action, so nearly all the code here is upstream's. Once the repo joins Last Light's managedRepos (yo61/flux-homelab#187) the Monday cron would scan it and file a summary issue of findings in code we don't own and can't act on.

How it works

Last Light resolves cron participation at tick time by reading each managed repo's .lastlight/lastlight.yml (apps/server/src/cron/repo-crons.ts upstream). The operator's bounds all permit it:

• repoConfig.enabled: true — the master switch for reading .lastlight/ at all
• repoConfig.allowKeys includes crons — the operator's kill switch would be to remove it
• the layer is read from this repo's default branch, resolved from the API rather than hardcoded, so master works

weekly-security-scan is the cron's name from workflows/cron-security.yaml upstream — the cron, not the security-review workflow it runs.

Scope

This drops the repo from one cron, not from Last Light. PR review and every other workflow still apply. Reverse it by deleting this file, or move the entry to crons.enable to opt back in.

[robinbowes]

Closing: the premise was wrong. Last Light cannot act on the upstream repo — every dispatch path is gated on managedRepos and the GitHub App has no installation on wagoid, so there was never cross-repo exposure to prevent. Issues are being enabled on the managed repos instead, so the security scan has somewhere to file findings.