fix: enforce repository attribution

[nothingnesses]

Summary

• Require the established repository author identity for every branch commit.
• Reject co-author trailers across the complete reachable history.
• Keep pull request product checks on the merge result while scanning branch metadata.
• Add isolated positive, negative, mailmap, shallow-history, and environment-safety cases.

Verification

• just ci passed over 1,513 commits.
• The attribution suite passed all 11 cases.
• Independent product review found three in-scope issues.
• Separate triage reproduced all three.
• One scoped fix closed them, and focused verification passed.

The commit and pull request use the established repository identity and contain no co-author trailer.