fix(ci): make grandfathered attribution commits rebase-safe

[allyblockcast]

Thinking Path

• Paperclip's PR policy gate protects repository history from commits stamped by the shared GitHub App identity.
• The gate grandfathered specific pre-cutoff commits by raw SHA because their original authorship cannot be recovered safely.
• The master merge queue is configured by ruleset 20487141 with merge_queue.merge_method: REBASE.
• Queue rebases preserve the patch and author but necessarily produce a new SHA, so raw-SHA grandfathering ejects otherwise-valid PRs only after enqueue.
• This pull request keys the exemption by stable git patch-id plus the exact App author email and adds the requested regression test.
• The benefit is that the queue and pull-request policy paths produce the same verdict without weakening the fail-closed behavior for unregistered content.

Linked Issues or Issue Description

Refs: BLO-27142

What Changed

• Replace raw grandfathered SHA matching with patch-id plus author-email matching.
• Register the existing grandfathered commits under their stable patch IDs.
• Add a regression test that rebases an App-attributed grandfathered commit and verifies it still clears the gate.

Verification

• node --check scripts/check-commit-author-attribution.mjs
• node --test scripts/check-commit-author-attribution.test.mjs (28 tests, 28 pass, 0 fail)
• Live ruleset query: gh api repos/Blockcast/paperclip/rulesets/20487141 --jq '{name,enforcement,conditions,rules}' returned active merge_method: REBASE.
• git diff --check

Risks

• Low runtime risk: only the grandfather path changes, and it still requires both the exact App author email and an enumerated patch ID.
• A patch-id collision would share an exemption; pairing with the author email and retaining a finite allowlist limits that risk.
• PR fix(monitor): two-surface PR review gate check (BLO-22574) #1126 and the five sibling PRs were not enqueued by this PR because queue mutation requires explicit shared-infrastructure approval on the issue.

Model Used

OpenAI GPT-5.6 Terra (openai/gpt-5.6-terra), tool-using coding agent with repository inspection, GitHub API access, and local test execution.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template
• I have run tests locally and they pass
• I have added or updated tests where applicable
• I have considered and documented any risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

Paperclip issue: https://paperclip.blockcast.net/BLO/issues/BLO-27142

[allyblockcast]

🔗 Paperclip issue: BLO-27142

[allyblockcast]

🔗 Paperclip issue: BLO-27142

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: f8ecc54

Critical Issues (0)

Important Issues (0)

Suggestions (1)

• scripts/check-commit-author-attribution.test.mjs:23 — Align the test helper's git show arguments with the production helper (--no-ext-diff --no-renames) so the fixture computes the same patch-id representation that CI enforces, including for rename-heavy commits.

Strengths

• The allowlist remains explicit and pairs each patch-id with the exact App author email.
• Local enforcement computes the patch-id from the checked-out commit while audit mode remains intentionally unallowlisted and historical.
• The rebase regression test verifies that the rewritten commit SHA is rejected while the registered stable patch-id is accepted.

Recommended Action

1. Consider the test-helper alignment suggestion opportunistically.
2. No Critical or Important issues block merge.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: 9069238

Critical Issues (0)

Important Issues (0)

Suggestions (1)

• scripts/check-commit-author-attribution.test.mjs:23 — Align the test helper's git show arguments with the production helper (--no-ext-diff --no-renames) so the fixture computes the same patch-id representation that CI enforces, including for rename-heavy commits.

Strengths

• The allowlist remains explicit and pairs each patch-id with the exact App author email.
• Local enforcement computes the patch-id from the checked-out commit while audit mode remains intentionally unallowlisted and historical.
• The rebase regression test verifies that the rewritten commit SHA is rejected while the registered stable patch-id is accepted.

Recommended Action

1. Consider the test-helper alignment suggestion opportunistically.
2. No Critical or Important issues block merge.