fix(git): strip cursor attribution trailers locally

[Drswith]

Summary

Add a repository-owned simple-git-hooks commit-msg sanitizer that strips Cursor's local attribution trailers before Git finalizes a local commit. The hook removes both Co-authored-by: Cursor Agent <cursoragent@cursor.com> and Made-with: Cursor, while keeping the existing remote CI / PR-governance policy generic rather than narrowing it to Cursor only.

Linked Artifacts

• Issue:
• ADR:
• OpenSpec: openspec/changes/strip-cursor-attribution-locally
• Discussion:

Validation

• bun run memory:check
• bun run lint
• bun run format:check
• bun run typecheck
• bun run test (if behavior changed)
• Not run, explained below

Release Intent

• Release: patch - local git workflow fix that prevents Cursor attribution trailers from leaking into commits

Docs Updated

• Not needed
• docs/...
• openspec/...
• Follow-up issue or OpenSpec change created instead

Scope Check

• I did not add a new ad hoc root-level Markdown file.
• I updated the relevant issue, ADR, spec, runbook, or captured the missing doc work as follow-up.
• I did not silently expand project scope without recording it explicitly.

Closure Check

• Working tree was clean after commit.
• Branch was pushed and this PR is the active delivery artifact.
• OpenSpec change is not needed, still active by design until merge, already archived, or queued for agent-driven archive closure.
• Release is not applicable, delegated to release automation, or verified.

Notes

The new local hook is intentionally narrower than CI:

• it strips Cursor's known local attribution formats before commit creation
• it does not replace the broader remote Co-authored-by: and risky-author governance
• Made-with: Cursor is removed locally, but is not yet a dedicated remote merge-gating failure condition