fix(builder): remove real email from commit history on origin/main

[iap]

Replaces the squash merge commit on main that contained a real email address in the commit message body. The new commit is GPG-signed, uses GitHub no-reply email in file content, and has a clean commit message body with no real email. Addresses Greptile finding about non-deliverable email and incomplete GPG instructions.

[greptile-apps]

Security-policy scope names a repository as an organization

iap/builder resolves to this repository, owned by the iap user; it is not a GitHub organization. Saying that the policy covers all repositories under the iap/builder organization leaves reporters unable to tell whether it applies only to this repository or to a broader account scope. State the intended scope explicitly, such as “This policy covers only the iap/builder repository,” or name the actual organization/account if it is meant to cover multiple repositories.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Artifacts

Executable security-policy scope validation script

• The exact Bash script executed from `/home/user/repo` reads line 31, derives the configured repository, and queries GitHub metadata; it proves the claimed organization path is not an organization.

Initial security-policy scope validation output

• The initial captured command output shows line 31, the `iap/builder` origin path, a 404 literal organization lookup, and a 200 repository lookup; it shows the scope wording is ambiguous.

Expanded security-policy scope validation output

• The final captured command output additionally extracts the live repository owner as `iap User` while the literal organization lookup remains 404; it confirms `iap/builder` is not an organization.

_{Ran code and verified through T-Rex}