Assistant emits forbidden attribution trailer despite CLAUDE.md rule against it

## Summary

When a user's `CLAUDE.md` explicitly forbids AI attribution in commits and MRs, the assistant still repeatedly produces the forbidden attribution trailer (a `Co-Authored-By` git trailer naming the Claude model). A separate enforcement layer (in my case a user-configured hook) then blocks the commit. The user's explicit instruction should take precedence on the first attempt, and it does not.

This is related to #56847, but distinct: that report is a pure harness-vs-guardrail conflict with no user configuration. This one adds the part not previously covered — an explicit user rule forbidding attribution that the assistant does not honor.

## Environment

- Permission mode: interactive
- User `CLAUDE.md` contains a rule: no AI/tool attribution in commit messages or MR descriptions (no co-author trailers, no "generated with" footers).
- A `system-reminder` is injected into the session instructing the assistant to append the co-author trailer to commits and a tool-branded footer to MR descriptions. That reminder states that the user's own instructions take precedence.

## Repro

1. User `CLAUDE.md` forbids AI attribution.
2. Session also carries the harness `system-reminder` prescribing the attribution trailer/footer.
3. Ask the assistant to commit changes and open an MR across several separate requests.

## Observed

On each commit/MR, the assistant defers to the harness reminder and adds the forbidden trailer. The enforcement layer blocks it each time. The assistant then retries without the trailer and succeeds. This repeated on three separate commits in one session.

## Expected

When a user's `CLAUDE.md` (or memory) explicitly forbids attribution, the assistant should not add it in the first place. The harness attribution `system-reminder` should not fire, or should be clearly subordinate, when a user instruction forbids attribution — so that no enforcement layer is needed to catch it.

## Notes

The reminder already concedes user instructions win; the gap is that the assistant does not reliably act on that precedence, so the forbidden text is emitted anyway.