test: fail the build on a Co-Authored-By trailer

[ruleofcodedev]

The Co-Authored-By trailer belongs to the tooling some contributors run, not to this repository. It reached nine commits before anyone noticed. Discipline did not catch it, so a gate does.

What lands

• tests/regression/commit-trailer-guard.test.ts — scans every authored commit and fails on the trailer, naming the offending SHA rather than just going red.
• The eight already-published commits are listed by full SHA, so nothing is grandfathered vaguely. That list is a ratchet: a separate assertion fails if it ever grows, because adding a SHA to excuse a new commit is the box-ticking this project refuses to accept from anyone else.
• CLAUDE.md (new) — the rule for automated contributors, with the other conventions learned the hard way: run the full suite rather than the files you think you touched; verify commit line lengths in a step of their own, since chaining the check to the commit means committing before reading the check.
• CONTRIBUTING.md — the same rule for humans.

Why the eight stay

Rewriting master and develop and breaking three release tags to delete one line is not a trade worth making. The decision is recorded in the test itself, next to the SHAs it covers.

Verdict impact

None. No detector, law, threshold or default changes — this is a project-local convention gate.

Evidence

• Proven red: a throwaway commit carrying the trailer failed the test with its own SHA in the output (Received: ["b4fae96 test: probe the trailer guard"]), then was removed.
• Proven green: passes against this branch, whose own commit carries no trailer.

Gate

• npm run lint — 0 errors
• npx jest — 504 suites / 13866 tests, exit 0
• node dist/cli.js audit — passed 35, failed 0