fix(contributors): stop fabricating profile links from unverified commit metadata #5506

What this fixes

The public /{owner}/{repo}/contributors page had the exact "anyone can claim to be a contributor" problem the owner flagged about GitHub — shipped on our own site:

1. Fabricated profile links. The page derived a handle from the commit email's local part and linked it to /{handle}. A commit forged as torvalds@linux-foundation.org (one git config user.email away) rendered as a clickable @torvalds profile link — impersonation by construction.
2. "Maintainer" by commit count. The badge went to whoever had the most commits (idx === 0), not the actual owner — spammable by pushing junk commits.
3. Dishonest framing. "Click a name to open their profile" implied every entry was a real, verified person.

What ships now

• A profile is linked only when the commit email matches a registered account with a verified email (emailVerifiedAt set), not deleted, not suspended. Uses the identity machinery the platform already has instead of inventing a parallel one.
• Owner badge comes from actual repo ownership (matched username == repo owner). Matched accounts get Verified (green); everyone else gets Unverified with "commit metadata only" and no link — with tooltips explaining both.
• Page copy states plainly that names/emails are self-reported commit metadata unless matched.
• DB matching failure degrades every card safely to the unlinked state — the page never fails to render because of the trust upgrade.

Typecheck clean; no tests asserted the old behavior.

🤖 Generated with Claude Code