fix(tooling): strip AI attribution at commit time instead of at review time

[mfethe1]

The problem

Buzz history does not carry AI-assistant attribution — no Co-authored-by:
trailer naming an assistant, no Generated with <tool> footer. But that rule
lived only in reviewers' heads, which made it expensive to enforce: a reviewer
had to spot the trailer, and the author then had to rewrite already-pushed
history to remove it. It has now blocked at least two PRs (#6036, #6077) for
exactly this.

Two gaps kept it recurring, and this closes both.

It was undocumented. AGENTS.md said nothing about it — not on main, not
anywhere in the repo. An agent following the contributor guide faithfully would
still emit the trailer, because several harnesses add one by default. So the
rule was, in practice, discoverable only by having a PR rejected.

Nothing enforced it. The commit-msg hook already rewrites the message to
append the DCO signoff, so the machinery was there; it just wasn't used for
this.

What this does

• scripts/strip-ai-attribution.sh removes assistant Co-authored-by:
  trailers and Generated with <tool> footers from a commit message in place.
• lefthook.yml runs it in the existing commit-msg hook, now marked piped
  so the strip completes before the signoff append rather than racing it on the
  same file.
• AGENTS.md states the rule, names the hook, and gives the repair path for a
  branch that already carries a trailer.

Two things it deliberately does not do

It never eats a human co-author. Matching is on assistant identity — a
known assistant name in the name position, or a known noreply address — not on
the word "AI". Stripping a real person's pair-programming credit would be a
worse failure than leaving a bot trailer in, so Co-authored-by: Jane Developer <jane@example.com> survives untouched. Tested.

It never touches Signed-off-by:. Dropping it would fail the required DCO
Check. Tested.

Known limitation, stated rather than hidden

Git runs commit-msg only for git commit and git merge. A git rebase or
git cherry-pick can still carry a trailer through — the same caveat the
existing signoff command already carries, and which lefthook.yml documents at
the hook. AGENTS.md now names it explicitly and gives the pre-PR check:

git log --format='%(trailers)' origin/main..HEAD

A CI-side guard would close this properly and is the obvious follow-up. It is
not in this PR because making a new check required needs a ruleset change,
and an unrequired check that silently passes would give false confidence.

Verification

Gate	Result
node --test scripts/strip-ai-attribution.test.mjs	7 passed, 0 failed
lefthook.yml parses; commit-msg ordering confirmed (piped: true, strip before signoff)	verified
This PR's own commit carries a DCO signoff and no attribution trailer	verified via git log --format='%(trailers)'

The tests cover both directions: assistant trailer removed, noreply-address-only
trailer removed, Generated with footer removed with and without the emoji,
human co-author preserved, DCO signoff preserved, unrelated message unchanged,
and the blank-line run left by a stripped footer collapsed.

Not verified here: lefthook's own dispatch was not executed in this
environment — Hermit fails to bootstrap on this Windows box (HERMIT_STATE_DIR_RAW: unbound variable), so just hooks could not install the hook to exercise it
end to end. The script itself is tested directly, and the wiring was checked by
parsing lefthook.yml. Worth a reviewer confirming the hook fires on a machine
with a working Hermit.