Adds CommitOptions.authorship and the keeper commit CLI sink-reading ($KEEPER_AUTHORSHIP_SINK) — the box-side of GitAI authorship provenance (keeperd reconciles the claim into the signed L3). See bounded-systems/door-keeper#12 and claude-box GITAI-PROVENANCE.md.