fix(gateway): no model self-attribution in agent commits

Two layers: generated agent settings now set includeCoAuthoredBy: false
(never set anywhere before, so the CLI nudged models into appending
'Co-Authored-By: Claude ...' to commit messages), and the commit verb
strips AI-attribution lines deterministically at the chokepoint every
provider routes through.

tests/unit/gateway/test_commit_prefix.py

@@ -117,6 +117,45 @@ async def test_commit_strips_then_re_adds_prefix() -> None:
     assert "[wrong-id]" not in msg
 
 
+@pytest.mark.asyncio
+async def test_commit_strips_ai_attribution_trailer() -> None:
+    """Model self-attribution lines never reach git — agent commits carry the
+    agent's own identity, not the model vendor's."""
+    aid = uuid4()
+    tid = uuid4()
+
+    t = MagicMock(
+        id=tid,
+        assigned_to=aid,
+        active_claimant_id=aid,
+        plan="x",
+        status="in_progress",
+        branch_name="feature/backend/abcd1234",
+    )
+    task_svc = AsyncMock()
+    task_svc.get_active_task_for_agent.return_value = t
+    git_svc = AsyncMock()
+    git_svc.commit.return_value = {"sha": "deadbeef"}
+
+    deps = _make_deps(task=task_svc, git=git_svc)
+    actions = ContentActions(deps)
+
+    await actions.commit(
+        agent_id=aid,
+        message=(
+            "docs(qa): capture the quality-gate diagnosis notes\n\n"
+            "Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>\n"
+            "🤖 Generated with Claude Code"
+        ),
+    )
+
+    msg = git_svc.commit.await_args.kwargs["message"]
+    assert "Co-Authored-By" not in msg
+    assert "anthropic.com" not in msg
+    assert "Generated with" not in msg
+    assert "capture the quality-gate diagnosis notes" in msg
+
+
 @pytest.mark.asyncio
 async def test_commit_prefix_collapses_multiple_spaces() -> None:
     """`[old]   foo` should become `[new] foo`, not `[new]   foo`."""

tests/unit/runtime/test_cc_lockdown.py

@@ -86,6 +86,18 @@ class TestSharedClaudeCredentialsDenied:
         assert "Read(//home/agent/.claude/.credentials.json)" in deny, deny
         assert "Read(//home/agent/.claude.json)" in deny, deny
 
+    def test_settings_set_include_co_authored_by_false(self) -> None:
+        """Suppresses the CLI's default Claude co-author commit trailer —
+        agent commits carry the agent's identity, not the model vendor's."""
+        orch = _orch()
+        path = orch._generate_agent_settings(
+            agent_id="be-dev-1",
+            role="developer",
+            workspace_path=_WS,
+            cell_workspace_path=_CELL,
+        )
+        assert json.loads(Path(path).read_text())["includeCoAuthoredBy"] is False
+
     def test_deny_uses_absolute_double_slash_form(self) -> None:
         """Per the #167 gotcha: a single leading / resolves against the
         settings.json project root, not the container filesystem root — an