docs: lead the homepage with the GitHub App (#59)

Before: the homepage's main button opened the Action guide, and the
"Where it runs" cards highlighted the Action ("Most teams start here").
The Team plan card linked the App repository, which is private, so
visitors got a 404. The AI attribution article and Getting started never
pointed GitHub users at the App first.

After: the main button installs the GitHub App, and the App takes the
highlighted middle card ("Fastest to set up"); the Action keeps its card
next to it. The Team card links the App guide's Plans section and says
what that section already says: until the plan launches, the App checks
an organization's private repositories at no charge. The article and
Getting started point GitHub users at the App before the CLI setup.

The App installs today from https://github.com/apps/commit-check, so the
site should send GitHub visitors there first.

| | Before | After |
|---|---|---|
| Hero button | "Add to GitHub Actions", opens the Action guide |
"Install the GitHub App", opens github.com/apps/commit-check |
| Where it runs | Action in the highlighted middle card, "Most teams
start here" | App in the highlighted middle card, "Fastest to set up";
Action unflagged next to it |
| Team plan card | "Until then, the Action covers private repositories
for free." Link: the private App repository (404) | "Until it launches,
the App checks them at no charge." Link: the App guide's Plans section |
| AI attribution article | Goes straight to the `pip install` try-out |
A paragraph first: install the App, commit a `cchk.toml` that sets
`ai_attribution`; free for public repositories and personal accounts |
| Getting started | No mention of the App before the CLI setup | A tip,
"On GitHub and want nothing to install?", with the install link |
| `docs/example.md` | "cannot move the terminal's cursor" | "cannot send
control sequences to the terminal" (CodeRabbit's note on #58: newline
and tab still move the cursor) |

How: text and link changes only, in `docs/index.md`, the article,
`docs/getting-started.md` and `docs/example.md`. `mkdocs build --strict`
and `pytest tests/` pass locally, and the built App guide has the
`#plans` anchor the Team card links to.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Documentation**
- Updated setup guidance to recommend the GitHub App for checks on
pushes and pull requests without maintaining a workflow file.
- Clarified differences between GitHub App, CLI, and hook-based setup
options.
  - Added guidance on trying disclosure policies locally.
- Documented that commit-message lines beginning with `::` are escaped
to prevent control sequences and workflow commands.
- Updated integration and pricing information, including App coverage
for organizational private repositories.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>

Author: shenxianpeng

docs/blog/posts/ai-commit-attribution-policy.md

@@ -141,7 +141,15 @@ branch's ruleset or branch protection, and a commit that fails it cannot be
 merged. [Where to run it](../../guides/integrations.md) walks through each
 setup.
 
-To try the disclosure policy without writing a config file:
+On GitHub, the quickest way to get there is the
+[Commit Check App](https://github.com/apps/commit-check): install it on a
+repository or an organization, commit a `cchk.toml` that sets
+`ai_attribution`, and every push and pull request gets a **Commit Check**
+result, with no workflow file to maintain. The App is free for public
+repositories and personal accounts.
+
+To try the disclosure policy on your machine first, without writing a config
+file:
 
 ```bash
 pip install commit-check

docs/example.md

@@ -239,8 +239,9 @@ To override the detection:
 
 Whatever the destination, the commit text in a failure is printed inert.
 Control characters other than newline and tab appear as `\xNN`, and a line
-that starts with `::` is printed as `\::`, so a commit message cannot move the
-terminal's cursor or send a GitHub Actions runner a workflow command.
+that starts with `::` is printed as `\::`, so a commit message cannot send
+control sequences to the terminal, or workflow commands to a GitHub Actions
+runner.
 `--format json` is not affected; JSON escapes those characters already.
 
 ### Checking a range of commits

docs/getting-started.md

@@ -5,6 +5,13 @@ commit message on your machine, and wired into the two places it belongs.
 
 It takes about five minutes and needs nothing but a Git repository.
 
+!!! tip "On GitHub and want nothing to install?"
+
+    [Install the GitHub App](https://github.com/apps/commit-check): every push
+    and pull request gets a **Commit Check** result, with no workflow file. The
+    [App guide](guides/github-app.md) covers what it checks. This page sets up
+    the CLI and the hook, which work with any Git host.
+
 ## 1. Install
 
 === "pip"

docs/index.md

@@ -34,7 +34,7 @@ description: Commit policy as code for teams and AI agents. Messages, branches,
 <h1 id="cc-title" class="cc-display">Catch bad commits <span class="cc-accent">before they merge.</span></h1>
 <p class="cc-lede"><strong>Commit policy as code for teams and AI agents.</strong> Commit Check validates commit messages, branch names, authors and sign-offs against one <code>cchk.toml</code> — in your commit hook, in CI, on every pull request and inside your AI agent. When the fix is obvious, it hands you the line.</p>
 <div class="cc-actions">
-<a class="cc-btn cc-btn--primary" href="guides/github-actions/">Add to GitHub Actions <svg viewBox="0 0 16 16" aria-hidden="true"><path d="M3 8h9M8.5 4l4 4-4 4" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/></svg></a>
+<a class="cc-btn cc-btn--primary" href="https://github.com/apps/commit-check">Install the GitHub App <svg viewBox="0 0 16 16" aria-hidden="true"><path d="M3 8h9M8.5 4l4 4-4 4" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/></svg></a>
 <div class="cc-install"><span class="cc-install__sigil" aria-hidden="true">$</span><code>pip install commit-check</code><button class="cc-copy" type="button" data-copy="pip install commit-check" aria-label="Copy the install command"><svg viewBox="0 0 16 16" aria-hidden="true"><rect x="5" y="5" width="8.5" height="8.5" rx="2" fill="none" stroke="currentColor" stroke-width="1.4"/><path d="M10.5 3.2A1.5 1.5 0 0 0 9 2H4a2 2 0 0 0-2 2v5a1.5 1.5 0 0 0 1.2 1.5" fill="none" stroke="currentColor" stroke-width="1.4"/></svg></button></div>
 </div>
 </div>
@@ -102,23 +102,23 @@ conventional_branch  = <span class="cc-t-pass">true</span></div>
 <code class="cc-surface__code">- id: check-message</code>
 <span class="cc-surface__go">Hook guide →</span>
 </a></li>
-<li><a class="cc-surface cc-surface--main" href="guides/github-actions/">
-<span class="cc-surface__icon"><svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="12" r="9" fill="none" stroke="currentColor" stroke-width="2"/><path d="M10 8.5v7l5.5-3.5z" fill="currentColor"/></svg></span>
-<span class="cc-surface__flag">Most teams start here</span>
-<span class="cc-surface__kicker">Enforced in CI</span>
-<span class="cc-surface__name">GitHub Action</span>
-<span class="cc-surface__desc">A required check no one can skip, with a PR comment and a job summary.</span>
-<code class="cc-surface__code">commit-check-action@v2</code>
-<span class="cc-surface__go">Action guide →</span>
-</a></li>
-<li><a class="cc-surface" href="guides/github-app/">
+<li><a class="cc-surface cc-surface--main" href="guides/github-app/">
 <span class="cc-surface__icon"><svg viewBox="0 0 24 24" aria-hidden="true"><path d="M12 3l8 4.5v9L12 21l-8-4.5v-9zM12 12l8-4.5M12 12v9M12 12L4 7.5" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linejoin="round"/></svg></span>
+<span class="cc-surface__flag">Fastest to set up</span>
 <span class="cc-surface__kicker">Zero YAML</span>
 <span class="cc-surface__name">GitHub App</span>
 <span class="cc-surface__desc">Install once. Every push and pull request gets a check run, no CI minutes.</span>
 <code class="cc-surface__code">apps/commit-check</code>
 <span class="cc-surface__go">App guide →</span>
 </a></li>
+<li><a class="cc-surface" href="guides/github-actions/">
+<span class="cc-surface__icon"><svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="12" r="9" fill="none" stroke="currentColor" stroke-width="2"/><path d="M10 8.5v7l5.5-3.5z" fill="currentColor"/></svg></span>
+<span class="cc-surface__kicker">Enforced in CI</span>
+<span class="cc-surface__name">GitHub Action</span>
+<span class="cc-surface__desc">A required check no one can skip, with a PR comment and a job summary.</span>
+<code class="cc-surface__code">commit-check-action@v2</code>
+<span class="cc-surface__go">Action guide →</span>
+</a></li>
 <li><a class="cc-surface" href="guides/mcp/">
 <span class="cc-surface__icon"><svg viewBox="0 0 24 24" aria-hidden="true"><rect x="4.5" y="8" width="15" height="11" rx="3" fill="none" stroke="currentColor" stroke-width="1.8"/><path d="M12 4v4" stroke="currentColor" stroke-width="1.8" stroke-linecap="round"/><circle cx="9.5" cy="13.5" r="1.3" fill="currentColor"/><circle cx="14.5" cy="13.5" r="1.3" fill="currentColor"/></svg></span>
 <span class="cc-surface__kicker">For AI agents</span>
@@ -442,7 +442,7 @@ conventional_branch  = <span class="cc-t-pass">true</span></div>
 <ul class="cc-plans">
 <li class="cc-plan"><p class="cc-plan__name">Open Source</p><p class="cc-plan__price">Free</p><p class="cc-plan__desc">Public repositories, on any account.</p><a href="https://github.com/apps/commit-check">Install the App →</a></li>
 <li class="cc-plan"><p class="cc-plan__name">Personal</p><p class="cc-plan__price">Free</p><p class="cc-plan__desc">Private repositories on a personal account.</p><a href="https://github.com/apps/commit-check">Install the App →</a></li>
-<li class="cc-plan cc-plan--soon"><p class="cc-plan__name">Team</p><p class="cc-plan__price">Coming soon</p><p class="cc-plan__desc">Private repositories in an organization. Until then, the Action covers private repositories for free.</p><a href="https://github.com/commit-check/commit-check-app">Watch for the launch →</a></li>
+<li class="cc-plan cc-plan--soon"><p class="cc-plan__name">Team</p><p class="cc-plan__price">Coming soon</p><p class="cc-plan__desc">Private repositories in an organization. Until it launches, the App checks them at no charge.</p><a href="guides/github-app/#plans">How the plan will work →</a></li>
 </ul>
 <p class="cc-plans__note">Nothing is blocked while you try it: without a config file the App reports its findings but leaves the check run neutral. GitHub's own commit-metadata rules sit behind its Enterprise plan — <a href="compare/github-rules/">the arithmetic, and the caveats →</a></p>
 </div>