[0x19]

Adds a small check that fails a pull request when its title, description or any of its commits credits an AI agent, and a push to main that brings such a commit in. Commits and PRs carry only the owner.

This is the server-side half of the local git hooks on the Mac and nevio-server. Those strip AI lines from commit messages and refuse pushes that still carry them, but a PR description is written on GitHub, so only a check here can catch it.

It runs on vars.CI_LIGHT_RUNNER where a repo sets one (core uses its self-hosted runner) and on ubuntu-latest otherwise. On private repos without self-hosted runners it starts working once Actions billing is enabled.

The matching was tested against five cases: an AI "Generated with" line in a description, an AI co-author trailer in a PR commit, one in a pushed commit, and two clean cases (a human co-author, an empty description). All five gave the expected result, and actionlint is clean.

To make it blocking, add no AI attribution / check as a required status check on main.

[0x19]

Local gate (CI paused, RFC 0154): head 04add4e adds only .github/workflows/no-ai-attribution.yml; it parses as YAML (one job, actions pinned by SHA) and is byte-identical to the same file in the other 8 repos; no file overlaps main. Squash merge, pre-approved on a green local gate.