Attribute automatic commits to Lnk User and scope project commits to projects/

[fuzzyporpoise]

Summary

Adds per-invocation identity attribution for every automatic lnk commit, replacing the old behavior that wrote Lnk User <lnk@localhost> into the repo's local .git/config and permanently shadowed the user's real identity. Automatic project commits are now scoped to the projects/ tree, and lnk doctor detects and repairs repos polluted by older lnk versions.

What's new

• Per-invocation machine identity - automatic commits (lnk add, create, remove, forget, move, doctor, init, format, and project push/sync/untrack/remove) are authored as Lnk User <lnk@localhost> via -c arguments, so git config is never touched and machine-made changes are easy to tell apart.
• Ambient identity for manual commits - lnk commit and git commit resolve the user's own identity from environment or config, with a lnk-identity fallback so identity-less environments still commit instead of hard-failing.
• Legacy identity detection - lnk doctor flags a local .git/config carrying exactly Lnk User <lnk@localhost>, and lnk doctor --fix unsets it, restoring the user's ambient identity for their own commits.
• Project-scoped commits - project push, sync, untrack, and remove stage, change-check, and commit only projects/, so unrelated work elsewhere in the lnk repo is never swept in.

Behavior changes / guardrails

• Git config is never mutated; per-invocation -c is highest precedence, so direnv and GIT_CONFIG_GLOBAL setups keep working for the user's own commits.
• Machine commits disable GPG signing (commit.gpgSign=false), so unattended runs never hit an interactive or unavailable key.
• Identity resolution mirrors git's own: GIT_AUTHOR_*, GIT_COMMITTER_*, and EMAIL count as ambient identity, and the fallback only fires when nothing resolves.
• The doctor match is exact-pair only; a user who intentionally configured that name is not affected, and polluted repos are surfaced by doctor rather than auto-healed.
• Project commits ignore unrelated changes whether staged or not; a pre-staged host-scope change stays staged for the user's own commit.

Testing

• Unit tests cover ambient, fallback, and env-var identity resolution, pathspec-scoped commits with pre-staged unrelated changes, and the legacy identity scan/fix cycle.
• make check runs fmt, vet, lint, unit, and integration suites; all green.