Hooks outside the visible conversation can inject Co-Authored-By or "Generated with Claude Code" lines into a commit or PR after it's already created, even when a no-attribution rule is active. Add Phase 3 to ship-it: after Phase 2 publishes, check the actual persisted commit message(s) and PR description (not the text composed inline) for attribution, and strip it via commit --amend + force-push and gh pr edit. Only runs when a global/user/project rule forbids attribution footers. Also syncs README docs for ship-it (now three phases) and mirror-it (GitHub target-repo existence check/creation, already shipped in plugins/dist but undocumented).