docs(adapters): cross-link the static no-git-push check (PAPA-441)

Follow-up to 017fcb0ea: the linter pointed AUTHORING.md at
scripts/check-no-git-push.mjs so adapter authors learn about the
build-time enforcement at the same place they learn the contract, and
know to use the `// paperclip:allow-git-push: <reason>` marker for
operator-configured exceptions.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/adapters/AUTHORING.md

@@ -45,5 +45,14 @@ which asserts that a remote-only commit propagates to the local worktree
 through `prepareWorkspaceForSshExecution` → `restoreWorkspaceFromSshExecution`
 with no git remote configured at any point.
 
+A static check enforces the rule before runtime ever sees it:
+[`scripts/check-no-git-push.mjs`](../../scripts/check-no-git-push.mjs) scans
+adapter and runtime source (`packages/adapters/`, `packages/adapter-utils/`,
+`server/src/`, `cli/src/`) and fails the `policy` CI job if any unapproved
+`git push` invocation is added. If you are building an operator-configured
+path that legitimately must push, add a
+`// paperclip:allow-git-push: <reason>` comment on the line (or the line
+above) so the opt-in shows up in code review.
+
 For the architecture-level write-up of cross-run persistence, see
 [`docs/guides/board-operator/execution-workspaces-and-runtime-services.md`](../../docs/guides/board-operator/execution-workspaces-and-runtime-services.md#cross-run-persistence-no-remote-git-contract).