ci: gate PRs on AI disclosure and flag unreviewed AI attribution

[dev-jodee]

Summary

• Add .github/PULL_REQUEST_TEMPLATE.md with a required two-box AI disclosure, and a pr-hygiene workflow that fails any PR that does not check exactly one box (and, when AI was used, states the tool and extent).
• Second job scans the PR title, description, commits, and branch name for AI tool attribution and a canary word. External PRs that hit it are labeled ai-unreviewed, commented on once with what to fix, and failed. The label is removed automatically when the attribution is cleaned up.
• Contributors with write or admin access are exempt from the attribution scan, so maintainer workflows are unaffected.
• AGENTS.md tells coding agents to include the canary word in any PR text, commit message, or review reply they draft on a contributor's behalf, which is what makes an unread submission detectable.
• CONTRIBUTING.md: disclosure is now mandatory rather than "helpful", the PR section points at the template and notes CI enforcement, and the AI use section documents the attribution rule and the "explain every line without an LLM" expectation.

Why: this repo takes a high volume of external contributions and a growing share arrive with Generated with Claude Code footers, Co-Authored-By: Claude trailers, or codex/ branches still in place. That is a reliable signal the author never read the diff, and today it is caught by hand, per PR, during review. Ported from solana-foundation/kora#665.

Test Plan

• actionlint .github/workflows/pr-hygiene.yml: clean.
• Exercised the disclosure grep locally against the template: untouched template fails, one box checked passes, both boxes checked fails, AI box with no tool/extent text fails, AI box with text passes, and a checked box hidden inside a multiline HTML comment fails.
• pnpm check (prettier) clean.
• The workflow itself only runs from main once merged (pull_request_target), so its live behavior is verified after merge on the next contributor PR.

AI disclosure

Check exactly one. See CONTRIBUTING.md.

• No AI tooling was used beyond editor autocomplete.
• AI tooling was used. Tool and extent: Claude Code drafted all files under direction, replicating ci: gate PRs on AI disclosure and flag unreviewed AI attribution kora#665; the author reviewed every change.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable new failures or outstanding previous findings remain.

Summary

• Introduces a pull request template with mutually exclusive disclosure options.
• Validates disclosure text and flags external submissions containing unreviewed AI attribution.
• Documents contributor and coding-agent expectations.
• Since the previous review, uses a canonical documentation link and cleans stale labels from newly exempt maintainer PRs.

_{Reviews (3) · Last reviewed commit: "ci: harden disclosure parsing and label ..."}

[amilz]

LGTM: adds PR-hygiene CI (AI disclosure gate + attribution scan) and docs; CI green.