ci: enforce mappable co-author credit

Add AUTHOR_MAP plus a lightweight co-author trailer checker so harvested commits use numeric GitHub noreply identities, reject bot/tool trailers, and require machine-readable credit when a commit says it was harvested from a PR.

Also normalize the local unpushed v0.9 harvest range so existing contributor authors/trailers for HUQIANTAO, Implementist, jrcjrcc, xyuai, cyq1017, idling11, and shenjackyuanjie use GitHub-mappable identities before the branch is published.

Validation: python3 scripts/check-coauthor-trailers.py --author-map .github/AUTHOR_MAP --range origin/main..HEAD --check-authors; python3 -m py_compile scripts/check-coauthor-trailers.py; ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci.yml")'; git diff --check; negative in-process validation for raw email, missing harvested credit, and bot author cases.

docs/AGENT_ETHOS.md

@@ -23,6 +23,12 @@ could not cover by ourselves.
   issues, keep author/co-author attribution where possible, add
   `Harvested from PR #N by @handle`, and credit the contributor in the
   changelog or release notes.
+- Make credit machine-readable. If a harvested commit cannot preserve the
+  contributor as the author, add a `Co-authored-by` trailer with the GitHub
+  numeric noreply address from `.github/AUTHOR_MAP` or
+  `gh api users/<login> --jq '"\(.id)+\(.login)@users.noreply.github.com"'`.
+  Do not use `.local`, placeholder, bot/tool, or raw third-party emails for
+  human contributor credit.
 - Deferral is a maintainer action, not a dismissal. If a PR or issue is not
   ready, say what is blocked, what evidence would change the decision, and
   which part of the work remains valuable.