You should simply do the Vim side of this where it is supposed to be done, in after/ftplugin/gitcommit.vim.
If you want to take the "modeline" route, just put the following line in that file:
setlocal modeline
but be advised that this has security implications.
If you want to take a more "in-Vim" route, just put the following line in that file:
setlocal colorcolumn=50,73
Note that this is a bit naïve because those numbers are not a hard rule: they are conventions that can change from project to project. The following is slightly smarter because it uses user-modifiable variables instead of hardcoded numbers:
:let &l:colorcolumn = get(g:, 'gitcommit_summary_length', 50) .. ',' .. (&textwidth == 0 ? 73 : &textwidth + 1)
But I don't know of a "universal" way for project maintainers to set both message line length and summary length at the project level so this looks like the best "in-vim" compromise for now.
FWIW, I think that your original commit.template strategy is the best, here.
Now, regarding the last section of your self-answer…
Doing stuff in $VIMRUNTIME might seem like a good idea if you really don't want your settings to be applied on a pre-user basis but it is generally a bad idea that should not be advised lightly.
As can be seen from its path on OP's machine, $VIMRUNTIME is major.minor version-dependent. This means that whatever the user did in /usr/share/vim/vim82/ will need to be redone in /usr/share/vim/vim90/, and so on when the user choses to upgrade. That's more work than necessary, and more opportunities for breaking things.
Note: some distributions, like MacVim, may not be affected by this potential issue.
Even if the user doesn't upgrade to another major.minor version, patch level updates can and will happen, that could silently override the user's changes to $VIMRUNTIME. That's more bad surprises that will require even more work than necessary and create even more breakage opportunities.
It is very easy to accidentally introduce the wrong line endings when editing files in $VIMRUNTIME, which can lead to all kinds of troubles.
This is all very fragile so, if you are not an admin of some kind, or maintaining an in-house image or something, please keep your fingers out of $VIMRUNTIME.
FWIW, this is how you can set EditorConfig at the project or global level:
[.git/COMMIT_EDITMSG]
max_line_length = 63
but it only gives you textwidth. There is no officially supported way to set a desired summary length so that's only half the battle.
As mentioned in the comments, .gitconfig and .git/config files can contain arbitrary values (I had no idea) but those things are local so they can't be used by project maintainers to "enforce" a particular summary line length as it would require tooling support… that doesn't seem to exist ATM. .gitattributes could be more helpful, maybe, because it can be tracked.