docs: add pre-push checks for gpgsig and Claude committer identity

Author: imlk0

CLAUDE.md

@@ -25,3 +25,26 @@ Fix any errors or warnings reported before proceeding with the commit.
 > `libdevmapper`, etc.) that may not be present in all dev environments. If they fail
 > solely due to missing system dependencies (not code errors), the CI pipeline will
 > serve as the authoritative check. `cargo fmt --check` must always pass locally.
+
+## Pre-Push Checks
+
+Before pushing, verify that no commits in the push carry a gpgsig header or a Claude committer identity:
+
+```bash
+for sha in $(git log --format="%H" origin/$(git rev-parse --abbrev-ref HEAD)..HEAD 2>/dev/null); do
+    git cat-file -p "$sha" | grep -q "^gpgsig" && echo "ERROR: commit $sha has gpgsig — rewrite with filter-branch before pushing" && exit 1
+    git log -1 --format="%ce" "$sha" | grep -qi "anthropic" && echo "ERROR: commit $sha has Claude committer — rewrite with filter-branch before pushing" && exit 1
+done
+echo "Pre-push checks passed"
+```
+
+If any commit fails, rewrite the committer with:
+
+```bash
+git filter-branch -f --env-filter '
+  if [ "$GIT_COMMITTER_EMAIL" = "noreply@anthropic.com" ]; then
+    export GIT_COMMITTER_NAME="$(git config user.name)"
+    export GIT_COMMITTER_EMAIL="$(git config user.email)"
+  fi
+' <base-commit>..HEAD
+```