fix(decisions): stop crediting AI agents as decision-record deciders

[ss-o]

Summary

Four accepted decision records credited an automation identity in Deciders:

ADR	Was	Now
0004	ss-o, Gemini CLI	ss-o
0005	ss-o, Claude Code	ss-o
0006	ss-o, Claude Code	ss-o
0007	ss-o, Claude Code	ss-o

This contradicts two existing rules. Organization policy bans crediting a bot or AI agent as a co-author, enforced for commit trailers by the commit-msg hook in scripts/git-hooks. And runbooks/adr.md reserves decision authority for a maintainer: an agent may draft a record, it never decides one.

In each case ss-o was the actual decider, so the agent is dropped rather than the record rewritten. No decision content changed.

This was surfaced by the decision index added in #576 — putting all 21 records in one table made the four outliers visible immediately, which is the kind of drift the index exists to catch.

Enforcement

Prose alone would drift back, so scripts/decision-records.py now rejects an automation identity in Deciders. This is the decision-record half of the rule the commit-msg hook already enforces for commit trailers, matching [bot] suffixes and known agent product names. It runs in CI with the rest of the record contract.

Verified the check flags exactly the four known records and nothing else before correcting them, so the pattern is not over-broad. test_allows_human_deciders pins that a multi-human Deciders value stays valid.

Pre-existing defects also fixed

Both were latent because the CI lint job only scans files changed by a pull request, so a finding in an untouched file never surfaces until something else edits that file.

• scripts/test_validate_zsh_standard_policy.py failed black on a clean checkout of main. Reported in docs(decisions): accept ADRs 0018, 0020, 0021 and enforce the record contract #576; fixed here.
• decisions/0006-wiki-content-root-boundaries.md had prettier emphasis-style drift (*implementation* to _implementation_), surfaced because this change touches that file.

Worth noting: a whole-repository trunk check --all reports roughly 70 further findings across 288 files, all in files untouched by this change. That backlog is out of scope here and would need its own cleanup pass.

Verification

python3 -m unittest scripts/test_decision_records.py             17 tests, OK
python3 -m unittest scripts/test_validate_agent_policy.py        84 tests, OK
python3 -m unittest scripts/test_validate_zsh_standard_policy.py 99 tests, OK
python3 scripts/validate-zsh-standard-policy.py                  passed
python3 scripts/validate-agent-policy.py                         passed
python3 scripts/decision-records.py --check                      passed
trunk check --no-fix                                             27 files, no issues