Add a git-hygiene rule for signing identity during a history rewrite

[ptr727]

A history rewrite that re-signs commits (e.g. git filter-repo to strip PII) preserves each commit's author but makes the runner the signer, so a blanket re-sign leaves the maintainer's key over bot-authored commits (dependabot[bot], github-actions[bot]) - a signature that doesn't match the author, which GitHub marks unknown_key/unverified and a require-signed-commits ruleset rejects. This has now recurred three times (most recently ESPHome-Config PR #59), and AGENTS.md only stated the principle in passing ("you cannot sign another contributor's commits for them") without an operational rule.

Change

• AGENTS.md "Git and Commit Rules": a new two-gate rule - (1) scope the rewrite to only the commits that must change, which by default are your own, re-signed with your key; (2) if a commit that must change is not yours, re-identify its author/committer to the signing identity before re-signing, so signature and author agree.
• docs/repo-config-carry.md: cross-reference from the brownfield re-signing note.

Verification

CRLF preserved, no em-dash (fleet uses spaced hyphens), markdownlint clean.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds an operational, explicit git-hygiene rule to prevent producing commits whose signing identity cannot be verified after a history rewrite (for example, when re-signing rewritten history that originally came from bots), and threads that guidance into the repo-config carry documentation.

Changes:

• Add a new “history rewrite” bullet under AGENTS.md -> Git and Commit Rules describing two gates for safe rewrites and a post-rewrite verification check.
• Extend docs/repo-config-carry.md brownfield migration guidance with a cross-reference to the new rule when bot commits are involved.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
AGENTS.md	Adds a new operational rule for scoping history rewrites and aligning rewritten commit identity with the signing key.
docs/repo-config-carry.md	Adds a cross-reference in the brownfield migration section pointing readers to the history-rewrite rule.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

AGENTS.md:33

• The verification guidance says to confirm commits are "signed and committed under your identity", but git log --show-signature shows the author by default and may not display the committer identity you are trying to validate. Also, "a your-key signature" is grammatically awkward.

Consider rephrasing that clause and using a git log format that includes the committer (e.g. --pretty=fuller) so the check actually validates committer vs signer.

- **A history rewrite includes only the commits that must change, and re-identifies any commit it rewrites that is not yours.** Filtering history (`git filter-repo` / `filter-branch`, e.g. to strip PII) rewrites the touched commits and you re-sign them with your key, while the tooling preserves each commit's original `author` and `committer` unless told otherwise. GitHub verifies a signature against the commit's `committer` identity, so a your-key signature over a commit still committed by a bot (`dependabot[bot]`, `github-actions[bot]`) or by GitHub's web-flow does not match its committer and is marked `unknown_key`/unverified, which a require-signed-commits ruleset then rejects. Two gates keep committer and signature aligned. **First, scope the rewrite to only the commits that must be modified** - by default those are your own, whose committer is already your identity, and a commit that does not need changing is kept out of the rewrite so its identity and signature are never touched. **Second, if a commit that must change is not yours, set its `committer` to the signing identity before re-signing** (and its `author` too, since a rewrite that alters the content should not keep attributing it to the bot), so the committer GitHub verifies matches your key - the original bot attribution is deliberately given up as the cost of having to rewrite it. Never leave your signature over a commit committed by another identity. Verify after the rewrite that every rewritten commit is signed and committed under your identity (`git log --show-signature`).