fix(attribution): make git attribution opt-in by default

[chioarub]

Summary

• Make local commit and PR attribution opt-in by default.
• Preserve explicit attribution via settings.attribution.commit and settings.attribution.pr.
• Preserve deprecated includeCoAuthoredBy: true as an explicit compatibility opt-in.
• Update settings/help wording to reflect the privacy-preserving default.

Why

Partially addresses #1326. Private, regulated, and client-sensitive repositories may not allow AI/provider/model metadata in Git history or PR text unless explicitly enabled.

Behavior

• Default local commit attribution: off
• Default local PR attribution: off
• Explicit custom attribution: honored
• Deprecated includeCoAuthoredBy: true: keeps old default behavior
• Deprecated includeCoAuthoredBy: false: off
• Remote session URL attribution remains unchanged because it is separate from local Git authoring metadata.

Out of scope

• Memory write approval
• Auto-dream / memory persistence policy
• Repo-local policy files
• Commit-msg hook enforcement

Testing

• bun test src/utils/attribution.test.ts - passed, 20 pass / 0 fail.
• bun test src/commands/commit-message/commit-message.test.ts - passed, 7 pass / 0 fail.
• bun run build - passed.
• bun run typecheck - failed on the existing repo-wide baseline. Representative errors include missing modules such as ./services/compact/snipProjection.js, ../assistant/index.js, and ./postCommitAttribution.js, plus unrelated existing type errors across CLI/plugin/session modules. A filtered check for files touched by this PR only reports the pre-existing src/utils/attribution.ts dynamic import of ./attributionTrailer.js, which is already present on upstream/main.

Partially addresses #1326.

[chioarub]

Replaced by #1335 on a clearer branch with the CI test fix.