ci: reject attribution trailers and emails in commits and prs

[ZingerLittleBee]

Summary

Adds a guard that keeps attribution trailers and email addresses out of commit messages and PR text.

• .github/scripts/: shared matchers (attribution-lib.sh) plus three entry points. check-commit-msg.sh checks one message file, check-co-authors.sh checks every commit in base..head, and check-pr-attribution.sh checks the PR title and body.
• .github/workflows/check-commit-attribution.yml: runs on pull_request (opened, synchronize, reopened, edited) and scans every commit in the PR plus its title and description. The title and body are passed through env, never interpolated into the script; an empty body is handled.
• lefthook.yml: a commit-msg hook that runs the same matchers locally. There is no pre-commit hook. Run lefthook install once per clone; lefthook-local.yml is gitignored.
• CLAUDE.md: a rule that commit messages and PRs carry no attribution or email addresses.

What gets rejected: Co-authored-by trailers, generated-by / made-with signatures naming a coding agent, the robot-emoji "Generated" signature, assisted-by trailers, and any email address. Look-alikes such as icon@2x.png or "can generate reports" pass. Skipping the local hook with --no-verify or LEFTHOOK=0 does not get past CI.

Test plan

• bash -n on all four scripts; lefthook validate
• Rejected: both co-author trailers, the robot-emoji signature, an email in a commit message, and an email in a PR body
• Passed: a plain conventional commit, "This change can generate reports.", "Updated icon@2x.png", and an empty or unset PR body
• lefthook run commit-msg passes a clean message and rejects one with an email
• check-co-authors.sh passes on the last 8 commits of main

After merge

Mark Check commit attribution as a required check in branch protection. The workflow cannot enable that.