fix(ops-log): say 'unattributed' when there is no handle, not a unix login

The fallback recorded `lkraven@nh3-dev` when ALTHING_HANDLE was unset, which
reads like an answer while being the absence of one. It now records
`unattributed(lkraven@nh3-dev)` -- handles never contain @ or parentheses, so
the fallback cannot be mistaken for an identity.

Found by the commit hook's first independent test, which was not one I ran:
infra-hermes committed 0fe4da6 and the hook caught it unprompted -- but logged
him as lkraven@nh3-dev, not infra-hermes. His seat exports ALTHING_HANDLE from
althing-infra-hermes-seat-run.sh, while neither hermes-gateway.service nor his
pump unit carries it, so anything he does outside that one script logs with no
handle.

So the hook is real but partially blind: it distinguishes not-infra-ops from
infra-ops, which is enough to have told me e43e262 was not mine, and not
enough to name who made it. The env-var gap is his to close. Making the blind
spot announce itself in the record is mine -- an instrument that cannot answer
should say so rather than return something answer-shaped.

scripts/ops-log

@@ -83,14 +83,23 @@ OUTCOMES = ("ok", "changed", "failed", "refused", "skipped")
 # ─── identity ──────────────────────────────────────────────────────────────
 
 def agent_id() -> str:
-    """Who is acting. ALTHING_HANDLE is the fleet's agent identity and is set
-    per pane by dev-launch; fall back to user@box so a human shell is still
-    distinguishable rather than anonymous."""
+    """Who is acting. ALTHING_HANDLE is the fleet's agent identity.
+
+    When it is unset the record says so IN THE NAME — `unattributed(user@box)`
+    — rather than quietly recording a unix login as though it were an agent
+    handle. Handles never contain `@` or parentheses, so the fallback can never
+    be misread as one.
+
+    This is not hypothetical: infra-hermes's seat exports ALTHING_HANDLE from
+    `althing-infra-hermes-seat-run.sh`, but neither `hermes-gateway.service`
+    nor his pump unit carries it, so work he does outside that one script logs
+    with no handle. An entry that merely said `lkraven@nh3-dev` would look like
+    an answer while being the absence of one."""
     handle = os.environ.get("ALTHING_HANDLE", "").strip()
     if handle:
         return handle
     user = os.environ.get("USER") or os.environ.get("LOGNAME") or "unknown"
-    return f"{user}@{os.uname().nodename}"
+    return f"unattributed({user}@{os.uname().nodename})"
 
 
 def now_iso() -> str: