chore(AI_POLICY.md): forbid Co-Authored-By LLMs entries

AI_POLICY.md

@@ -12,7 +12,7 @@ must be in a quote block (e.g., using `>`) and disclosed as such. It must be
 accompanied by human commentary explaining the relevance and implications of
 the context.
 
-If you plan to contribute to termscp using AI tools, you **must** read,
+If you plan to contribute to this project using AI tools, you **must** read,
 understand and follow this policy.
 
 ## Disclosure
@@ -26,6 +26,18 @@ you submit — code, prose or commit messages — including agents, chat assista
 and AI-assisted editors. Mechanical editor autocompletion of a few characters
 does not need to be disclosed; if in doubt, disclose.
 
+## Authorship and responsibility
+
+You are the only author of, and the only party responsible for, everything you
+submit, no matter whether it was written by a human or by an AI tool. An AI
+tool is never an author or a contributor.
+
+Commits, pull requests and any other contribution **must not** contain
+`Co-authored-by` trailers (or equivalent attribution lines, such as
+`Generated-by` or session links) naming an LLM, an agent or any other AI tool.
+Disclose AI use through the pull request template, as described above, and
+nowhere else.
+
 ## Translations
 
 AI is useful when communicating as a non-native English speaker. If you are
@@ -55,6 +67,8 @@ Examples of things that are not allowed:
   without understanding the question or the response.
   In other words, you should not "play telephone" between your AI-generated code,
   the reviewer, and the AI tool.
+- Add a `Co-authored-by` trailer (or similar attribution) naming an LLM or
+  agent to a commit or pull request.
 
 ## Inspiration
 

deny.toml

@@ -21,9 +21,6 @@ unmaintained = "all"
 # dependency version; until then, connections to untrusted endpoints remain an
 # acknowledged denial-of-service and certificate-validation risk.
 ignore = [
-  # h2 0.3 is retained transitively by the reqwest 0.11/AWS HTTP stack; its
-  # dependency constraints cannot select the fixed h2 0.4 release.
-  { id = "RUSTSEC-2026-0258", reason = "owner: termscp maintainers; review by 2026-12-31; upgrade reqwest/AWS stack to fixed h2" },
   # number_prefix is retained by self_update through indicatif. It is
   # unmaintained, but has no reported vulnerability or compatible replacement.
   { id = "RUSTSEC-2025-0119", reason = "owner: termscp maintainers; review by 2026-12-31; upgrade self_update/indicatif" },
@@ -33,9 +30,6 @@ ignore = [
   { id = "RUSTSEC-2026-0195", reason = "owner: termscp maintainers; review by 2026-12-31; upgrade remotefs-webdav/self_update to quick-xml >=0.41" },
   # The SSH stack requires RSA, for which RustSec reports no safe upgrade.
   { id = "RUSTSEC-2023-0071", reason = "owner: termscp maintainers; review by 2026-12-31; replace RSA dependency when upstream fix exists" },
-  # rustls-pemfile is retained by the WebDAV and Kubernetes clients. Both
-  # versions are unmaintained but have no reported vulnerability.
-  { id = "RUSTSEC-2025-0134", reason = "owner: termscp maintainers; review by 2026-12-31; upgrade WebDAV/Kubernetes clients away from rustls-pemfile" },
 ]
 
 [licenses]