[Fix] Requester names appear on public repository changes

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Delimit generated provenance with invisible HTML markers so updates replace only server-owned attribution text instead of parsing display-name prose.
• Attribute public GitHub pull requests to the linked @username, falling back to generic Roomote provenance; unmarked public attribution receives only a full-line safety scrub and is not migrated.
• Require exact repository-host matches throughout PR resolution and attribution; a stamped host with no exact row remains unknown and public-safe.
• Use linked handles for Git authors only with a verified provider noreply email, and otherwise use the Roomote identity.

Why this change was made

Roomote account names are useful context inside private company repositories, but publishing those names on public projects can disclose profile information the requester did not intend to share. This keeps internal attribution while limiting public output to identity already exposed by the source-control provider.

Closes #1184.

Impact

Private repositories retain human-readable attribution when the repository identity is known. Public GitHub repositories show the linked handle or only Created by Roomote; public non-GitHub repositories remain generic until durable provider-handle mappings are available. New marked bodies update deterministically, while old unmarked bodies are not parsed or upgraded.

[roomote-community]

No new code issues found. See task

• packages/db/src/lib/source-control-provider.ts:52 rejects a host mismatch before permitting private attribution.
• packages/sdk/src/server/lib/pull-requests/source-control-pull-requests.ts:560 validates the entire public attribution line before preserving it.
• packages/db/src/lib/source-control-provider.ts:57 treats an unknown legacy host as a private repository match, which can disclose attribution on a same-name public repository hosted elsewhere.
• packages/sdk/src/server/lib/pull-requests/source-control-pull-requests.ts:238 rejects a legacy null-host private repository row for a stamped public host.

_{Reviewed f2923f8}

[roomote-roomote]

Implemented the attribution hardening and CI follow-up through 9f8019db.

The final design uses marker-delimited provenance for deterministic replacement, applies a full-line safety scrub to unmarked attribution-shaped text on public repositories, requires exact host matches when sourceControlHost is stamped, and only uses a public handle when paired with a verified non-Roomote provider noreply identity. Mixed, unresolved, or mismatched repository identity remains generic and public-safe.

The stale prompt-test expectations now match the marker-delimited format, the package's complete 619-test suite passes locally, and the changeset has been removed.

[roomote-roomote]

Fixed the remaining host-resolution finding in f2923f8e: stamped source-control hosts now require an exact repository-row match and cannot fall back to a legacy null-host private row. The complete SDK suite passes (854 tests), the PR metadata is refreshed, and the review thread is resolved.