ci: load workflow scripts as .cjs (fixes notifier/scan under "type": "module")

[afeezorobsco-cyber]

What changed

Renames .github/scripts/pr-conflict-notifier.js and .github/scripts/pr-malware-scan.js to .cjs, and updates the two workflows and ROADMAP.md to match.

Why

docforum-web's package.json has "type": "module", so Node treated the .js scripts as ES modules. Both workflows failed there with ReferenceError: module is not defined in ES module scope (the first conflict-notifier runs on web main failed this way). Malware scan is now a required check, so every web PR push would have been blocked. .cjs is always CommonJS whatever package.json says, so the scripts are renamed in all three repos to keep them identical and future-proof.

Testing

• Reproduced locally: in a directory whose package.json has "type": "module", require() of the old .js fails, and both .cjs files load.
• Re-ran the scanner on the escrow Feat/multiple staff users per facility fixed roles no #163 fixture (3 HIGH, as before) and dry-ran the notifier against web (completes).

Which ROADMAP.md item does this close/progress?

Updates the file paths in the existing notifier and malware-scan items.

🤖 Generated with Claude Code

[github-actions]

Malware scan: passed, with notes for the reviewer

Nothing malicious was detected in 0002dd4. These changes touch sensitive areas and should get a careful look before CI is approved:

Where	Rule	Why
.github/workflows/pr-conflict-notifier.yml:45	workflow-change	Changes a CI workflow; a maintainer must review before approving runs.
.github/workflows/pr-malware-scan.yml:4	workflow-change	Changes a CI workflow; a maintainer must review before approving runs.