feat(ops-log): record who committed, by althing handle

Two agents share ONE checkout of this repo on nh3-dev, and every commit here
is attributed to Vuong Hoang by convention -- so a commit's author line says
nothing about which agent made it. The ops log closed that gap for HOST
changes; it did not cover commits to the shared tree.

Found the hard way today: e43e262 appeared interleaved between two of this
session's commits, in this session's own reflog, and was unattributable from
git, from the ops log AND from the althing bus. It was sitting in the push set
at the time, and forseti had explicitly asked that unrelated management-repo
commits not be pushed -- so the one thing needed to honour that request was
the one thing nothing recorded.

The hook APPENDS to .git/hooks/post-commit rather than replacing it, because
graphify already owns that file and core.hooksPath would disable it.
Best-effort by construction: a failure here must never fail a commit.

scripts/git-hooks/install.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Chain the ops-log attribution hook onto .git/hooks/post-commit.
+#
+# APPENDS rather than replaces: graphify already owns that file, and
+# core.hooksPath would disable it. Idempotent — safe to re-run.
+set -euo pipefail
+REPO="$(git rev-parse --show-toplevel)"
+HOOK="$REPO/.git/hooks/post-commit"
+if [ ! -f "$HOOK" ]; then
+  printf '#!/bin/sh\n' > "$HOOK"; chmod +x "$HOOK"
+fi
+if grep -q "post-commit-ops-log" "$HOOK"; then
+  echo "already installed"; exit 0
+fi
+printf '\n# ops-log attribution hook (scripts/git-hooks/post-commit-ops-log)\n"$(git rev-parse --show-toplevel)/scripts/git-hooks/post-commit-ops-log" || true\n' >> "$HOOK"
+echo "installed — commits now record their althing handle to the ops log"