ci: protect author privacy and validate PR commit identities

[xPROMSx]

Summary

• Add concise repository-wide privacy/Codex rules in AGENTS.md, including repository-local public Git identity and no disclosure of private identifiers in code, PRs, tests, fixtures or logs.
• Add a PR-only check of both author and committer for each newly introduced commit (base..head). Existing history on the base branch is excluded. Accept the agreed public noreply identity, the existing public GitHub profile alias, ordinary GitHub web/automation identities, and matching public GitHub noreply handles; reject non-public/mismatched addresses.
• Report only abbreviated commit SHA plus failure category; never echo rejected names or addresses into CI logs.
• Register the new check as mandatory in CI / Required, with a separate safe success path for push events. Add synthetic unit tests covering allowed/rejected identities, historical commits, and log redaction.

Scope

CI/policy-only: seven files. No production code, installed proxy behavior, history rewriting, repository settings, or additional dependencies. Existing GitHub Actions suites remain mandatory.

Validation

Exact diff reviewed against current main. Full GitHub Actions are expected on this PR; do not merge until all jobs including CI / Commit identity and CI / Required succeed. Independent audit before merge.