ops: add CI lint for Co-Authored-By/Claude/Anthropic trailers

Three builder runs tonight carried a Co-Authored-By: Claude trailer
despite bold instructions forbidding it. A rule in a prompt is not a
control — this gate is. Flags commits in a PR's range carrying
co-authored-by + (claude OR anthropic OR noreply@anthropic.com),
case-insensitive, covering all observed spellings.

Wired into CI (new attribution-trailer job) and pre-push hook. Mirrors
existing lint scripts in structure and exit conventions. Pattern tested
against all three variants plus a normal commit.

.forgejo/workflows/ci.yml

@@ -68,6 +68,23 @@ jobs:
         # their own. See scripts/check-doc-refs.sh.
         run: sh scripts/check-doc-refs.sh
 
+  attribution-trailers:
+    name: attribution-trailer lint
+    runs-on: [hive-ci]
+    # Pure git — seconds.
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: lint
+        # Flags Co-Authored-By trailers with Claude/Anthropic attribution
+        # in PR commits (hive convention in /knowledge/hive-rules.md forbids
+        # them — an attribution line in a prompt is not a control). Own
+        # job, and IS a required check on the forge (branch protection) — a
+        # hit blocks merge. See scripts/check-attribution-trailers.sh.
+        run: sh scripts/check-attribution-trailers.sh
+
   prose-lint:
     name: prose lint (vale)
     runs-on: [hive-ci]