check-ai-co-authors.sh does not match Amp trailers despite naming Amp in its comment

`check-ai-co-authors.sh` is intended to block agent co-author trailers, but no pattern matches Amp's actual trailer, so branches carrying one pass green.

### The gap

`.github/scripts/check-ai-co-authors.sh:11-13`:

```sh
AGENT_PATTERNS=(
# Anthropic — Claude Code / Amp
'noreply@anthropic\.com'
```

The comment names Amp, but the pattern beside it only matches `noreply@anthropic.com`. Amp's trailer is `Co-authored-by: Amp `. `grep -c ampcode` over the script returns **0**, and the generic catch-alls enumerate Claude, Copilot, Cursor, Codex, Gemini, Aider, Devin, Windsurf, Cline, Amazon Q, Jules, and OpenCode — but not Amp. The comment reads as intent that was never implemented.

### Observed, not hypothetical

Found across several open PRs while working through review backlog. In each case the `Check for AI agent co-author trailers` job reported **success** on a branch that does carry an Amp trailer:

- #16957 — `cfe694b79e` (squash of #17102) carries `Co-authored-by: Amp `; check green.
- #8186 — `f4a92ad` carries `Amp-Thread-ID:` **and** `Co-authored-by: Amp`; `f455f55` carries `Amp-Thread-ID:` alone; check green.
- #9435 — `dc106b69c7` and `4b21bb6e4b` carry `Amp-Thread-ID:`; `6d47feb145` is authored by `cheap-drain `; check green.
- #12144 — `ff088ebb` carries `Co-Authored-By: Claude`. This one the check **does** catch, which is the contrast that makes the gap visible.

### Two separate holes

1. **Missing vendor pattern.** Add `ampcode\.com` (covers both the `Co-authored-by` trailer and `@ampcode.com` author addresses).
2. **Trailer-only inspection.** The script reads `Co-authored-by:` trailers. It does not look at `Amp-Thread-ID:` trailers or at commit *authorship*, so `git commit --author='Amp '` passes regardless of vendor coverage. `AGENTS.md` says "Never mention Claude/AI in commits", which is broader than what the script enforces.

Worth deciding whether the check should match the written rule or whether the rule should be narrowed to what is mechanically enforceable. Right now they differ, and the difference is invisible to anyone relying on the green check.

### Suggested fix

Add the vendor pattern, and extend the scan beyond `Co-authored-by:` to the full commit message and the author/committer fields. Verify with a control — a commit deliberately carrying an Amp trailer must fail the check before the fix is trusted.

Read `.github/scripts/check-ai-co-authors.sh` and the commit rule in `AGENTS.md` first; determine whether the check should enforce the broader rule or the rule should be narrowed. Use a commit with an Amp trailer as the control, and check the author/committer and `Amp-Thread-ID` cases described in the issue. Done means the selected policy is enforced consistently and the control no longer passes unnoticed.

Written by the indexing model from the issue text.