ci(i18n): enforce controlled crowdin localization workflow and pr validation

Add Crowdin pull request validation script, centralize locale configuration, and update GitHub workflows to enforce sparse target catalog validation.

.github/pull_request_template.md

@@ -61,7 +61,7 @@ AI assistance is welcome on this project; unreviewed AI output is not. See the
 - [ ] I read every line of the final diff
 - [ ] `pnpm verify` passes against the final diff
 - [ ] Tests added or updated per the [testing expectations](https://github.com/bookorbit/bookorbit/blob/main/docs/CONTRIBUTING.md#phase-7-write-and-run-tests)
-- [ ] User-facing text is localized and accessibility was checked, where applicable
+- [ ] User-facing text uses Vue I18n keys added only to `client/src/locales/en.json`; non-English catalogs are unchanged, and accessibility was checked
 - [ ] Documentation updated, where applicable
 - [ ] No unintended files, secrets, build artifacts, or personal configuration included
 - [ ] No new dependencies, or the addition was discussed and approved in the linked issue

.github/workflows/ci.yml

@@ -190,6 +190,25 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           pnpm-version: ${{ env.PNPM_VERSION }}
 
+      - name: Enforce localization change policy
+        shell: bash
+        env:
+          IS_CROWDIN: ${{ steps.crowdin.outputs.is_crowdin }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          validator="$RUNNER_TEMP/validate-locale-pr.mjs"
+          if git cat-file -e "$PR_BASE_SHA:scripts/validate-locale-pr.mjs" 2>/dev/null; then
+            git show "$PR_BASE_SHA:scripts/validate-locale-pr.mjs" > "$validator"
+          else
+            git show "$PR_HEAD_SHA:scripts/validate-locale-pr.mjs" > "$validator"
+          fi
+          node "$validator" "$PR_BASE_SHA" "$PR_HEAD_SHA" "$IS_CROWDIN"
+
+      - name: Test PR policy scripts
+        run: node --test scripts/validate-locale-pr.test.mjs
+
       - name: Lint PR title
         shell: bash
         env:

.github/workflows/crowdin-translations.yml

@@ -60,7 +60,7 @@ jobs:
           CROWDIN_ALLOWED_TRANSLATION_LOSSES: ${{ inputs.allowed_translation_losses }}
           CROWDIN_PROJECT_ID: ${{ vars.CROWDIN_PROJECT_ID }}
           CROWDIN_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
-        run: node client/scripts/sync-crowdin-translations.mjs
+        run: pnpm --filter client sync:crowdin
 
       - name: Validate translation catalogs
         run: pnpm --filter client validate:locales