fix(hybrid-gate): make the inline attribution pattern a superset

[forkwright]

Finding

hybrid-gate.yml's embedded ai-attribution job and the standalone
no-ai-attribution.yml enforce the same policy through two different sources of truth, and the
embedded one is the weaker of the two. Repos that rely on hybrid-gate alone are enforcing a smaller
pattern set than repos calling the standalone workflow.

Evidence

The standalone workflow reads the caller's .github/no-ai-attribution-patterns.txt
(no-ai-attribution.yml:9-12,41). The embedded job does not read that file at all — it hardcodes an
inline regex (hybrid-gate.yml:471):

^(co-authored-by:.*(claude|gpt|codex|kimi|gemini|anthropic)|🤖|generated with)

Compared against a real caller's pattern file (aletheia's .github/no-ai-attribution-patterns.txt),
the inline pattern misses:

marker	in the pattern file	matched inline
Moonshot in a co-authored-by trailer	yes	no
OpenAI in a co-authored-by trailer	yes	no
🧠	yes	no
claude.com/claude-code	yes	no

Two further markers are missed by both, found by reading what the harness actually emits rather
than by inferring:

• Claude-Session: https://claude.ai/code/session_… — a trailer key sitting beside, not inside, the
  co-authored-by line, so the trailer alternate never sees it.
• A bare https://claude.ai/code/session_… on its own line. It carries no 🤖 and no
  generated with, so removing the marker line above it leaves this one standing — which is exactly
  what a partial scrub produces.

Why this matters

This is a reusable workflow, so the weaker of the two implementations is what most adopting repos
run. WORKFLOW/no-ai-attribution is a kanon gate Error and the operator's standing rule is that
no forkwright repo carries AI attribution, so a marker the shared gate does not match is a marker
that reaches main.

The direction of the fix matters too. The obvious cleanup — delete a repo's local duplicate and rely
on the shared job — would have reduced coverage here, because the local copy is a superset rather
than a duplicate. The shared floor has to rise first; only then is the local copy genuinely
redundant.

Desired correction

Make the inline pattern a superset of what any caller's pattern file holds, with each alternate
justified at the site by an observed marker rather than by guessing at vendor names.

Verified by running the new pattern against both directions:

• 8 of 8 real markers matched — the co-authored-by trailer, Claude-Session:, the
  generated-with line, a bare session URL, Generated with Codex, and moonshot/openai/🧠 variants.
• 4 of 4 legitimate prose lines correctly ignored — including a line that discusses a
  Co-authored-by: Claude trailer and one containing https://example.com/claude-code. The
  line-anchoring that makes that possible is preserved.

Done when: a repo enforcing attribution through hybrid-gate alone catches every marker a repo using
the standalone workflow catches.