Reject hidden PR body content

Authored-By: Codex (GPT-5) <noreply@openai.com>

README.md

@@ -73,7 +73,8 @@ The check validates four things for every non-break-glass Agent PR:
    `Fixes bug-<id>` automation token and the matching navigable
    `https://agenthub.fritzlab.net/bug-<id>` URL. Every PR has a separate
    `## Attribution` section containing the canonical `Authored-By`
-   product/model watermark.
+   product/model watermark. Agent-authored PR bodies cannot contain HTML
+   comment delimiters, so required provenance cannot be hidden from readers.
 
 4. **Commit attribution** — every commit in `base-sha..head-sha`, including
    commits on `chore/` branches, ends with