Follow-up: audit the preserved late v0.9.1 contributor-credit reconciliation

Preserved branch: [`codex/v091-4487-final-reconcile`](https://github.com/Hmbown/CodeWhale/tree/codex/v091-4487-final-reconcile)
Exact tip: `2d7da5730771c3ae5878d4146da4359d4be44152`

Unique preserved commit:
- `2d7da5730` reconcile final v0.9.1 community credit

The branch updates the allowlist, author map, changelogs, contributor docs, and web release credits. Later release-note commits changed overlapping files, so it must be audited entry-by-entry rather than merged as a block.

## How the next model should work

1. Refresh live `origin/main`, read the current `AGENTS.md`, and use an isolated worktree.
2. Treat the preserved branch as evidence, not as a merge-ready PR. It has an older base and may overlap later work.
3. Use `git log`, `git range-diff`, targeted diffs, and tests to identify behavior still absent from current main.
4. Harvest or reimplement the smallest coherent slices; preserve human attribution and any issue/PR references in commit bodies.
5. Run rustfmt, targeted tests, strict clippy for touched crates, then the required workspace gates. Do not close this issue from prose alone—attach exact SHAs and test receipts.

Do not merge the entire branch blindly, rewrite the preservation branch, or fold unrelated release work into the reconciliation.

## Acceptance

- Every materially used human contribution has GitHub-mappable authorship/credit.
- No contributor is dropped by later changelog slicing or release-note edits.
- `.github/AUTHOR_MAP`, `docs/CONTRIBUTORS.md`, changelogs, and web credits agree.
- Bot/tool identities are not added as human co-authors.
- The version/credit checks pass on current main.

Read the current AGENTS.md, refresh origin/main in an isolated worktree, and compare it with codex/v091-4487-final-reconcile using git log, git range-diff, and targeted diffs. Audit .github/AUTHOR_MAP, docs/CONTRIBUTORS.md, changelogs, and web release credits, then run the named version/credit checks plus rustfmt, targeted tests, strict clippy, and workspace gates. Done means current main preserves human attribution consistently without bot identities, with exact SHAs and test receipts attached.

Written by the indexing model from the issue text.