fix(ci): build the record separator instead of writing the byte

`pnpm check:nul-bytes` refuses a raw ASCII control byte in any tracked file,
and two places here carried one: the `git log -z` record separator and the
self-test fixture that exercises it. The escape was materialised into the byte
by the editor that wrote it, which is exactly the failure the gate names.

`String.fromCharCode(0)` cannot be materialised into anything.

Claude-Session: https://claude.ai/code/session_01MCLBsUgfykL74aU716rzVK
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

scripts/check-commit-card-trailers.mjs

@@ -364,6 +364,17 @@ function objectExists(sha, cwd) {
   }
 }
 
+/**
+ * The record separator `git log -z` writes between commits.
+ *
+ * Built rather than typed: this repository refuses a raw control byte in any
+ * tracked file (`pnpm check:nul-bytes`), and an editor asked to write the
+ * escape can materialise it as the byte itself — which is how this line got
+ * the gate's attention once already. `String.fromCharCode` cannot be
+ * materialised into anything.
+ */
+const NUL = String.fromCharCode(0);
+
 /**
  * The commits a rev-list range names, as `{ sha, message }` rows.
  *
@@ -377,7 +388,7 @@ export function readCommits(args, { cwd = ROOT, run = execFileSync } = {}) {
     maxBuffer: 64 * 1024 * 1024,
   });
   const rows = [];
-  for (const record of String(out).split('
+  for (const record of String(out).split(NUL)) {
     if (record.trim() === '') continue;
     const nl = record.indexOf('\n');
     if (nl < 0) {
@@ -714,7 +725,7 @@ function selfTest() {
   );
   t(
     'the walk reads NUL-terminated records, so a multi-line message stays one commit',
-    readCommits([], { run: () => 'abc\nfix(x): s\n\nbody\n def\nfix(y): t\n' }).map((c) => c.sha).join(','),
+    readCommits([], { run: () => ['abc\nfix(x): s\n\nbody\n', 'def\nfix(y): t\n'].join(NUL) }).map((c) => c.sha).join(','),
     'abc,def',
   );