ci: reject AI attribution and vendor-locked agent config

Calls the org-wide reusable workflow in imqueue/.github. It fails a push or
pull request whose commits carry an AI co-author trailer (`Co-Authored-By:
Claude ...`, `Claude-Session:`, `Co-authored-by: Copilot ...`), or that commit a
vendor-locked agent config file such as CLAUDE.md. AGENTS.md remains the one
supported agent file.

Trailer shapes only, never prose, and only unambiguous vendor tokens — so
`Co-authored-by: dependabot[bot]` and commit messages that discuss Claude,
Anthropic or AI crawlers keep passing.

Author: Mikhus

.github/workflows/no-ai-attribution.yml

@@ -0,0 +1,22 @@
+# Fails this push or PR if a commit carries AI attribution, or if a
+# vendor-locked agent config file (CLAUDE.md and friends) is committed.
+#
+# The rules live in imqueue/.github/.github/workflows/no-ai-attribution.yml.
+# They exist because GitHub renders a `Co-Authored-By: Claude ...` trailer as a
+# second author on the commit page — 148 such commits were rewritten out of this
+# org's history, and this check is what stops them coming back.
+#
+# The half that actually blocks is local: a commit-msg and pre-push hook running
+# the same rules. This is the backstop for --no-verify, a machine without the
+# hooks, and the GitHub web editor.
+
+name: No AI attribution
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  push:
+
+jobs:
+  attribution:
+    uses: imqueue/.github/.github/workflows/no-ai-attribution.yml@master