docs(nest): make commit attribution policy-neutral

[wesbillman]

Summary

• replace the generated Nest's unconditional human author/sign-off rules with portable guidance that separates authorship, material co-authorship, DCO certification, and cryptographic signing
• defer attribution to repository-local policy, forbid inferred or guessed identities, and require inspection of every outgoing commit
• bump the Nest template version so existing installations refresh, with regression coverage for fresh generation and upgrade preservation

Related issue

None found. Related runtime identity work exists in #6177, but this PR is intentionally limited to the generated Nest guidance and its refresh behavior.

Testing

• bin/just desktop-tauri-clippy
• bin/just desktop-tauri-test
• bin/just file-size-check
• git diff --check
• pre-push hooks: push-head-scope, branch-skew, file-size-check, and desktop-tauri-checks

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE
Reviewed: db5617dd1541aeab7bacaf039b6ca98f856776d0..de9ad7566be58cfde5701f00e8e541fbca03369b (exact live head)
Risk: low — generated Markdown policy and its versioned filesystem refresh; no runtime identity, relay/schema, UI, or release contract changed.

Behavior/contracts traced

• desktop/src-tauri/src/managed_agents/nest_agents.md:47-58 now treats authorship, material co-authorship, DCO certification, identity resolution, and cryptographic signing as separate claims. Repository-local policy remains authoritative; guessed identities and another person's signing key are explicitly forbidden.
• desktop/src-tauri/src/managed_agents/nest.rs:48-51,389-443 bumps the template version from 4 to 5 and uses the existing atomic refresh boundary: static pre-marker guidance is replaced while the managed section and all following repository-owned content survive.
• desktop/src-tauri/src/managed_agents/nest/tests.rs:44-57,449-475 covers fresh-template wording and a v4→v5 upgrade preserving managed and local content.

Findings: no blocking or non-blocking defects.

Author action: none.
Verification owner: none; required CI gates remain the CI/release gate's responsibility and are green/skipped as expected.

Validation at matching clean HEAD

• git diff --check db5617dd1541aeab7bacaf039b6ca98f856776d0..de9ad7566be58cfde5701f00e8e541fbca03369b — pass.
• Two independent bin/just desktop-tauri-test runs — pass; primary Tauri suite reported 2765 passed, 0 failed, 18 ignored, including both new regressions, with additional workspace suites passing. One reviewer's first cold-cache attempt exceeded a 600s harness timeout while tests were already running; the completed retry passed and this was not a product failure.
• Independent source/diff and upgrade-path review — clean exact head.
• Live checks immediately before submission: Desktop Core/Desktop, Rust Lint, macOS build, Windows Rust, smoke/integration E2E, release candidate, and DCO all successful; no failed/cancelled/timed-out check.

Manual/native evidence: not warranted. The changed artifact is generated Markdown exercised through filesystem regression tests, not rendered application UI.

Residual risk: downstream correctness still depends on each repository supplying clear local attribution policy. The template makes that dependency explicit; natural-language guidance cannot enumerate every repository's rules.

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE
Reviewed: db5617dd1541aeab7bacaf039b6ca98f856776d0..de9ad7566be58cfde5701f00e8e541fbca03369b (exact head de9ad7566be58cfde5701f00e8e541fbca03369b)
Risk: low — generated Nest guidance and its upgrade contract; no runtime identity, relay, schema, persistence, or release behavior changes.

Behavior/contracts traced: The generated guidance now distinguishes authorship, material co-authorship, DCO certification, identity resolution, and cryptographic signing while deferring to repository-local policy and forbidding guessed identity or use of another person’s key (desktop/src-tauri/src/managed_agents/nest_agents.md:47-58). Template version 4→5 activates refresh (nest.rs:48-51); refresh remains bounded before the managed marker and preserves managed/local content (nest.rs:389-443). Fresh-generation and v4-upgrade regressions cover those invariants (nest/tests.rs:44-57,449-475).

Findings: no blocking or non-blocking defect established.
Author action: none.
Verification owner: none beyond normal required CI gates.

Validation: bin/just desktop-tauri-test passed at the exact clean head (main suite: 2,765 passed, 18 ignored; additional workspace suites passed); git diff --check passed. Exact-head Desktop/Rust/build/E2E/release-candidate/DCO checks observed green. A cold-cache reviewer run first exceeded a 600-second timeout while tests were running; the completed prescribed rerun passed and is not a product failure.

Manual/native evidence: not warranted for generated Markdown and filesystem refresh behavior.
Residual risk: downstream attribution rules remain repository-policy-dependent by design; the generated text explicitly preserves that boundary.