feat(lint): add severityglyphs analyzer to keep the severity vocabulary in pkg/glyph

[aparajon]

Adds a severityglyphs go/analysis analyzer that flags string literals containing a severity glyph (🚨 ⛔ ❌ ⚠️ ℹ️) in non-test source files, pointing at the pkg/glyph constant to use instead. This is the enforcement piece of the severity-glyph vocabulary: with all rendering sites migrated, the analyzer keeps new code from reintroducing raw glyph literals that could drift surface by surface.

• The analyzer inspects decoded string values, so escape-spelled glyphs (❌) are caught the same as literal ones, and it matches base codepoints (⚠ U+26A0, ℹ U+2139) so variation-selector variants are caught too.
• Test files are skipped: assertions on rendered output deliberately pin the literal glyphs so they break when the vocabulary drifts.
• Apply-state glyphs (🚫 ⏹️ ⏸ ⏳ ↩️ 🔁 ✅) are a separate vocabulary owned by pkg/presentation and are not flagged.
• Callers own the package set (same contract as webhookheaders): pkg/glyph and the analyzer's own glyph table are excluded. Wired into the pre-commit hook over staged packages with the same default + integration build-tag matrix as closeandlog, plus a cmd/severityglyphs-check shim for standalone runs.

The full repo passes under both tag flavors.

Analyzer output on a violation

pkg/ui/example.go:4:35: severity glyph ⛔ in string literal — use glyph.Refused from pkg/glyph

severityglyphs: use the pkg/glyph constants (glyph.Escalation, glyph.Refused,
glyph.Failed, glyph.Attention, glyph.Info) instead of literal severity glyphs.

Stacked on #1152; only the last commit is new here.

This PR was generated by Claude Code (Claude Fable 5).