pr-checks: reject commits attributing work to an AI tool

Second, clone-independent check alongside the new local commit-msg/
pre-push hooks (ci_scripts/check_no_ai_attribution.sh) - a PR from a
checkout that never installed them still gets caught here.

Author: luhenry

.github/workflows/pr-checks.yml

@@ -30,6 +30,24 @@ jobs:
             exit 1
           fi
 
+      - name: Reject AI-attributed commits
+        # Catches what the local commit-msg/pre-push hooks
+        # (ci_scripts/git-hooks/, ci_scripts/check_no_ai_attribution.sh) exist to
+        # prevent, for a clone that never installed them.
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          status=0
+          for commit in $(git rev-list "$BASE_SHA..$HEAD_SHA"); do
+            if ! git log --format=%B -1 "$commit" | ci_scripts/check_no_ai_attribution.sh -; then
+              echo "::error::Commit $commit attributes work to an AI tool; see the message above."
+              status=1
+            fi
+          done
+          exit $status
+
   check_patches:
     runs-on: ubuntu-latest
     steps: