docs(agents): point the push step at the pre-push card-trailer refusal (#17752)

Fixes #17727

One clause added to `.claude/agents/os-dev.md`, on the push step,
pointing at the pre-push card-trailer refusal that PR #17745 adds. The
file already carries the rule (「卡片关系只在 PR 正文声明一次:commit ⛔ 不带卡片 trailer,其
trailer pair 一律 model-free。」); what it did not carry is that a hook now
refuses the push over it.

The line, before and after:

```
- 用 `git push -u origin claude/issue-<n>-<slug>` 推上去,网络失败退避重试。
- 用 `git push -u origin claude/issue-<n>-<slug>` 推上去,网络失败退避重试;pre-push 拒卡片 trailer。
```

**Line budget.** The file is at 403/403 with zero headroom (`pnpm
check:pm-skill-ratchet`), and the ratchet's ceiling is maintainer-only.
The clause therefore costs NO line: it rides the existing push line,
which grows 88 → 115 bytes, under the file's 120-byte widest-line
convention. Nothing was deleted to pay for it, and no line was
re-wrapped to free one. After the edit: `.claude/agents/os-dev.md is 403
lines (ceiling 403; headroom 0)` — green.

This is deliberately a separate PR from the code half: `.claude/**` is a
governed surface, so this one waits for a human merge while #17745 lands
through the queue. `node scripts/pm/check-governed-merges.mjs --test
.claude/agents/os-dev.md` → `⛔ GOVERNED — a human merge is the review
record for this PR`.

Gates run locally on this diff (derived with `node
scripts/pm/dispatch-gates.mjs --commands`, 17 commands, all exit 0):
`check:pm-skill-ratchet`, `check:pm-skill-id-lint`,
`check:agent-model-declared`, `check:agent-test-spelling`,
`check:doc-authoring`, `check:nul-bytes`,
`check:partof-closing-keyword`, `check:pm-governed-merges`,
`check:skill-frame-sync`, `check:watch-hint-literal`,
`check:refd-timer-probe`, `check:driver-memory-census`,
`check-closing-keyword-parity` (+ self-test),
`check-comment-mask-corpus`, `check-governed-queue-guard --self-test`,
and `check:doc-formula-expressions` (exit 3 PREREQUISITE NOT MET until
`@objectstack/formula` and `@objectstack/lint` were built, then exit 0).

## 维护者速读(草稿)

**改了什么** — `.claude/agents/os-dev.md` 的推送那一行加了半句:`pre-push 拒卡片
trailer`。仅此一处,不增行。

**为什么改** — 裁决 A(#17606 决策批次 #116)把 commit 卡片 trailer 的检查从 PR
时移到推送前。规则本来就写在这个文件里,但执行它的机制没有写:dev 读到「commit 不带卡片
trailer」,不知道推送会被钩子拦下,也就不知道此刻的修法是便宜的(改写未推送的
message),而不是推完之后无解的那种。这一句把规则和它的执行点连起来。

**风险与代价(含回滚)** — 风险极低:纯说明文字,不改任何行为;真正的机制在
#17745。行数账本未动(403/403),未删任何既有内容,未靠折行腾行。回滚就是回退这一个 commit;若 #17745 未落地而本
PR 先合,这半句会指向一个尚不存在的钩子 —— 因此建议在 #17745 落地后再合本 PR。

**席位意见** —

**你要做的** — 读这半句是否值得占那 27 字节;确认它指向的机制(#17745)已落地或即将落地;人工合并本 PR(受管面,任何 AI
席位都不得合并、入队或武装自动合并)。

---
_Generated by [Claude
Code](https://claude.ai/code/session_01MCLBsUgfykL74aU716rzVK)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.claude/agents/os-dev.md

@@ -274,7 +274,7 @@ model: opus
 - driver/kernel 启动路径同此;那时跑 `--project integration` 并在报告里说明,否则写已声明给 CI。
 - 层是测出来的,不是列出来的:spawn CLI 或启动 driver 的测试按 `packages/cli/vitest-tiers.ts` 落。
 - 分区 pin `test/vitest-tiers-partition.test.ts` 在某个测试文件两层皆无或皆有时变红。
-- 用 `git push -u origin claude/issue-<n>-<slug>` 推上去,网络失败退避重试。
+- 用 `git push -u origin claude/issue-<n>-<slug>` 推上去,网络失败退避重试;pre-push 拒卡片 trailer。
 - Draft PR 指向 `main`,正文首行 `Fixes #<n>`;合并不应关卡时用 `Part of #<n>`,并说明留下哪一半。
 - ⛔ 永不 `Fixes` 一张还在决策箱的卡:合并会静默关掉它,而收件箱过滤只读 open。
 - ⛔ 不写否定式的关单句,它照样关掉点名的卡:解析器无视否定,只匹配关键词 + `#<n>`。