feat(git): namespace contrib refs per account (contrib/<user>/<topic>)

Done before anyone has a token or a branch, because renaming later breaks every
contributor. The hook compares the middle path segment to REMOTE_USER, so a token
can only write under its own namespace; deletion and cleanup become a prefix
operation instead of a guess.

Verified 4/4: own namespace accepted, neighbour's namespace refused naming the
authenticated user, missing owner segment refused with the correct form, main
refused. Test branch and token removed afterwards; queue back to 0.

1 files changed, 5 insertions, 5 deletions

diff --git a/docs/usage.html b/docs/usage.html
index 017f6e4..f25a074 100644
--- a/docs/usage.html
+++ b/docs/usage.html
@@ -296,9 +296,9 @@ and read-only.</p>
 git remote add push https://push.newos.webx11.duckdns.org/newos4.git
 
 # 2. work on a branch, push it under contrib/
-git switch -c contrib/my-fix
+git switch -c contrib/&lt;your-username&gt;/my-fix
 git commit -am "fix(shell): handle an empty command"
-git push push HEAD:refs/heads/contrib/my-fix</code></pre>
+git push push HEAD:refs/heads/contrib/&lt;your-username&gt;/my-fix</code></pre>
 <p style="color:var(--dim);font-size:.9rem">Use a credential helper rather than pasting the token into the
 URL of a repository you might publish. Git will ask once and can remember it
 (<code>git config --global credential.helper store</code> writes it to a plain file — choose
@@ -307,7 +307,7 @@ URL of a repository you might publish. Git will ask once and can remember it
 <h3>What the server enforces</h3>
 <table>
   <tr><th>Rule</th><th>Reason</th></tr>
-  <tr><td>Only <code>refs/heads/contrib/*</code></td><td><code>main</code> and tags are generated by the publisher; a push there would disappear at the next publish</td></tr>
+  <tr><td>Only <code>refs/heads/contrib/&lt;you&gt;/*</code></td><td><code>main</code> and tags are generated by the publisher; a push there would disappear at the next publish. The middle segment must be your own username — the hook compares it to the account that authenticated, so nobody can overwrite a neighbour's branch</td></tr>
   <tr><td>No credentials in the diff</td><td>The repository is public. Every added blob is scanned before it is accepted; a match rejects the whole push with the file name</td></tr>
   <tr><td>No profile or key files</td><td><code>.user.json</code>, <code>.session</code>, <code>.env</code>, <code>*.pem</code>, <code>id_rsa</code> are refused by path</td></tr>
   <tr><td>≤ 200 files, ≤ 2 MB of new content per push</td><td>Keeps one push from making the mirror unusable</td></tr>
@@ -319,8 +319,8 @@ URL of a repository you might publish. Git will ask once and can remember it
 touching code is queued for a human with a diff summary, and a branch that breaks a hard rule is deleted.
 The queue is visible to the operator; you will hear back on your branch, not in a black hole.</p>
 <pre><code>git fetch push 'refs/heads/contrib/*:refs/remotes/contrib/*'
-git log --oneline main..contrib/my-fix      # what your branch adds
-git push push --delete contrib/my-fix       # withdraw it</code></pre>
+git log --oneline main..contrib/<your-username>/my-fix   # what your branch adds
+git push push --delete contrib/<your-username>/my-fix    # withdraw it</code></pre>
 
 <h2 id="updating">Updating later</h2>
 <pre><code>cd newos4