[bug] A100 Co-Authored-By trailer uses wrong user ID — attributes commits to @yufyu111

[rhowardstone]

What happened

The repo shows 3 contributors: rhowardstone, claude, and @yufyu111 (a stranger's account).

GitHub resolves Co-Authored-By trailers by the numeric user ID in the noreply email, not the username label. Three commits used:

```
Co-authored-by: QA Engineer (Claude) 215369405+rhowardstone@users.noreply.github.com
```

215369405 is @yufyu111's GitHub user ID, not rhowardstone's (which is 19674552). So GitHub correctly credited yufyu111 for those commits.

Affected commits

• f4a27d4 — [qa] test(contract): guard all 8 navbar page templates
• 4e050a4 — feat(review): schema-agnostic annotation plugin (#232)
• 097db63 — test(stages): QA validation layer for stages[] (#227)

Fix going forward

The A100 must NEVER construct a user-scoped noreply email in Co-Authored-By lines. Use only:

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Do NOT use <{user_id}+{username}@users.noreply.github.com> for any agent-generated commits. That ID was presumably scraped or hallucinated and happened to belong to an unrelated GitHub user.

The three old commits cannot be rewritten without a force-push to master (human decision). The contributor attribution will persist in the graph but poses no security risk — yufyu111 has no repo access.

Action required

• A100: stop using user-scoped noreply addresses in Co-Authored-By
• rhowardstone: decide whether to force-rewrite the 3 commits to remove the bad trailer (low priority)