docs: pin v2.20.5 and add its changelog entry (#84)

**Before:** the site describes 2.20.4. The six pre-commit snippets pin
`rev: v2.20.4`, the changelog stops at v2.20.4, and two pages describe
behaviour 2.20.5 changed:

- "Checking the committer" does not say the author checks were skipped
on a repository's first commit.
- CC017 says the advice names `user.*` and `GIT_AUTHOR_*`, and adds
`author.name` / `author.email` as a separate hint.

**After:** the site describes 2.20.5, published 2026-11-11.

- All six snippets pin `rev: v2.20.5`.
- The changelog has a v2.20.5 entry (four lines) and a Highlights row.
- "Checking the committer" says the identity is checked on a first
commit from 2.20.5 on.
- CC017 lists the four settings the advice itself now names.

What the released 2.20.5 prints in the two cases:

```console
$ git init -q . && git config user.name claude   # no commit yet, author_name_pattern set
$ commit-check --author-name
✖ Commit rejected by Commit Check · 1 check failed

✖ CC101 author-name failed: claude
  The committer name seems invalid
  Suggest: git config user.name 'Your Name'
  Docs:    https://commit-check.com/rules/#cc101
```

```console
$ echo "feat: add streaming support" | commit-check -m   # author.name is Claude, ai_attribution = "forbid"
✖ Commit rejected by Commit Check · 1 check failed

✖ CC017 ai-author failed: Claude <noreply@anthropic.com>
  An AI tool is the commit author: Claude Code
  Suggest: Commit as yourself: set git config user.name and user.email to your own, and unset author.name, author.email, GIT_AUTHOR_NAME and GIT_AUTHOR_EMAIL if a tool set them; a commit that already exists then needs git commit --amend --reset-author
  Docs:    https://commit-check.com/rules/#cc017
```

2.20.4 printed `⊘ skipped (not validated): author-name` for the first.

**How**

- "About half the time to start" in the changelog is measured on the two
released wheels with `commit-check -m <file>`: 480M instructions on
2.20.4 against 244M on 2.20.5 (callgrind), 119 ms against 68 ms wall
time (median of 25 runs).
- `tests/docs_sync_test.py` passes against the installed 2.20.5 (18
tests) and `mkdocs build --strict` is clean.
- Blog posts and the two homepage transcripts recorded with 2.20.4 are
left as they are.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Documentation**
* Added v2.20.5 release highlights covering first-use compilation of AI
signature patterns, PyPI provenance attestations, author checks on a
repository’s first commit, and updated CC017 guidance.
* Clarified which author identity settings can override `user.name` and
`user.email`, and when to unset them.
  * Updated pre-commit configuration examples to use v2.20.5.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>

Author: shenxianpeng

docs/changelog.md

@@ -11,6 +11,7 @@ page that documents it.
 
 | Version | What changed | Documented in |
 |---|---|---|
+| [2.20.5](#v2205) | The author checks cover a repository's first commit; a run takes about half the time to start; releases on PyPI carry provenance | [Checking the committer](example.md#checking-the-committer) · [CC017](rules.md#cc017) |
 | [2.20.3](#v2203) | Failures print a one-line header and an indented block per check, in place of the ASCII banner; an agent skill for coding agents | [Getting started](getting-started.md#2-watch-it-reject-something) · [With AI coding agents](guides/ai-agents.md#tell-the-agent) |
 | [2.20.1](#v2201) | `--ai-attribution-only` checks a pull request description against your AI policy; JSON lists the AI tools found; more AI marks recognised | [Checking a pull request description](guides/policies.md#checking-a-pull-request-description) · [CC013](rules.md#cc013) |
 | [2.20.0](#v2200) | Commits authored by an AI tool rejected; subject length `0` turns the rule off; Python 3.11+ required | [CC017](rules.md#cc017) · [CC013](rules.md#cc013) · [CC004](rules.md#cc004) |
@@ -39,6 +40,18 @@ page that documents it.
 | [2.5.0](#v250) | Organization-wide config with `inherit_from` | [Across an organization](guides/organization.md) |
 | [2.0.0](#v200) | Configuration moved from YAML to TOML — breaking | [Migrating from v1](migration.md) |
 
+## v2.20.5 (2026-11-11) { #v2205 }
+
+### Changed
+
+* A run takes about half the time to start: the AI signature patterns are compiled when first used. ([#693](https://github.com/commit-check/commit-check/pull/693))
+* Releases on PyPI carry provenance attestations. ([#691](https://github.com/commit-check/commit-check/pull/691))
+
+### Fixed
+
+* `--author-name` and `--author-email` check a repository's first commit, instead of being skipped until a commit exists. ([Checking the committer](example.md#checking-the-committer), [#692](https://github.com/commit-check/commit-check/pull/692))
+* CC017's advice for a message not yet committed names `author.name` and `author.email` among the settings to unset. ([CC017](rules.md#cc017), [#692](https://github.com/commit-check/commit-check/pull/692))
+
 ## v2.20.4 (2026-11-10) { #v2204 }
 
 ### Fixed

docs/compare/tools.md

@@ -65,7 +65,7 @@ Replace the hook:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-message
 ```

docs/configuration.md

@@ -274,7 +274,7 @@ Used from a hook definition, with no config file anywhere in the repository:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-message
         args:

docs/example.md

@@ -144,7 +144,9 @@ Without `--rev`, these validate the *local git config* — whoever is about to
 commit — falling back to `HEAD`'s author only when no identity is configured.
 The identity is read in git's order: `GIT_AUTHOR_NAME` and
 `GIT_AUTHOR_EMAIL` when set, then `author.name` and `author.email`, then
-`user.name` and `user.email`.
+`user.name` and `user.email`. From 2.20.5 on that identity is checked on a
+repository's first commit too; earlier versions skipped both checks until a
+commit existed.
 That is the right subject for a hook and the wrong one for CI: an existing
 commit's identity is a fact about the commit, not about the operator running
 the check. Add `--rev` and both checks read that commit's recorded author, and
@@ -167,7 +169,7 @@ pushed:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-no-force-push
         stages: [pre-push]

docs/guides/pre-commit.md

@@ -8,7 +8,7 @@ Add Commit Check to `.pre-commit-config.yaml`:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-message
       - id: check-branch
@@ -68,7 +68,7 @@ Options can be passed as hook arguments, which keeps everything in one file:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-message
         args:
@@ -90,7 +90,7 @@ colon, and lets the commit through:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-message
         args: [--fix]

docs/rules.md

@@ -753,9 +753,8 @@ is, and it is what GitHub shows as the contributor.
 The commit fails even with a human `Co-authored-by:` line. When the message
 is checked before the commit exists, there is nothing to amend yet, so the
 suggestion is to set `user.name` and `user.email` to your own and to unset
-`GIT_AUTHOR_NAME` and `GIT_AUTHOR_EMAIL`. If `author.name` or `author.email`
-names the tool, unset those as well: they outrank `user.name` and
-`user.email`.
+`author.name`, `author.email`, `GIT_AUTHOR_NAME` and `GIT_AUTHOR_EMAIL` if a
+tool set them. All four outrank `user.name` and `user.email`.
 
 **Options**