Scope the compatibility bump's git identity to its own commit

`ci/bump-tested-up-to.sh` ran `git config user.name "compatibility check"`
before committing. That writes .git/config and outlives the script, so from
the first run onward every commit in that working copy is authored by
"compatibility check <noreply@localhost>" with no Co-Authored-By trailer —
including a release made by a person days later about something else.

git announces an identity it cannot FIND and says nothing about one that is
wrong, so the missing case is loud and this one is silent. Nothing fails,
nothing warns, and the author is only visible to somebody reading `git log`
for another reason. Measured across the family by the Nolimit Security
session: six misattributed hand commits in one sibling including two
releases, two in another, one in a third. This tree was clean — no local
identity, 0 misattributed — and one run of the script away.

The commit still signs itself as the robot, which is right: that one is not
a person's. It just does it with `git -c … commit`, which configures the
command and not the clone.

Guarded in ci/static.sh, because the fix is one line and reverting it would
be invisible for exactly as long as nobody reads an author field. Widened
past what was reported: the pattern accepts any scope flag, since --global
is the same fault one scope wider and reaches every repository on the box.

Proven with a full matrix rather than one trigger — no flag, --local,
--global and --system each go red with the named message and exit 1; a
commented mention, `git -c user.name=… commit`, `git config core.autocrlf`
and `git config --global core.pager` all stay green. The correct form being
a control matters: a check that flagged the fix would get one of the two
deleted. Five of those assertions are now in ci/selftest.sh (36 total), each
with a landing check that the plant is in the file before its verdict is
believed, and the passing line carries the script count — "every script is
clean" reads the same over zero files as over eleven.

ci/ ships nothing, so there is no version bump and no release here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ci/bump-tested-up-to.sh

@@ -60,10 +60,15 @@ done
 git diff --quiet && { echo "Nothing actually changed on disk — check the sed patterns." >&2; exit 1; }
 
 branch="compat/tested-up-to-$current_wp-wc-$current_wc"
-git config user.name "compatibility check"
-git config user.email "noreply@localhost"
 git checkout -b "$branch"
-git commit -am "Tested against WordPress $current_wp and WooCommerce $current_wc
+# The identity is scoped to THIS commit with `git -c`, never written to the
+# clone. `git config user.name` persists in .git/config, so every later commit
+# in this working copy — a release days afterwards, by a person — would be
+# authored by the robot with no Co-Authored-By trailer. git announces a
+# MISSING identity and says nothing about a wrong one, so that is silent.
+# Signing this one commit as the robot is right: it is not a person's.
+git -c user.name="compatibility check" -c user.email="noreply@localhost" \
+  commit -am "Tested against WordPress $current_wp and WooCommerce $current_wc
 
 $(printf '%s\n' "${changed[@]}")