…ines.

Co-authored-by: GPT 5.5 <codex@openai.com>

Split the quality-expectations section into two paragraphs (the warning
about low-quality contributions being declined was visually merged with
the preceding paragraph). Replace "and the pull request closed without
warning" with a note that maintainers may not always be able to provide
detailed feedback, which conveys the same practical reality.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Add AI-disclosure and quality requirements to the contribution guidelines

Closes #2016

Users routinely hit GitCommandNotFound by passing a single string with
spaces to repo.git.execute(...). With shell=False (default) subprocess
treats the entire string as the executable name and fails. Document the
recommended list form, the string-as-single-executable behavior, and the
two ways to coerce a string into argv tokens (shlex.split or shell=True).

…g-arg

docs(cmd): clarify Git.execute() string vs list command argument

#2146 identifies two factual problems in #2144's `:param command:`
rewrite, both of which this fixes:

1. The claim that with `shell=False` a string "is passed as a single
   executable name to `subprocess.Popen`" is accurate on Unix-like
   systems, but on Windows `subprocess.Popen` forwards the string to
   `CreateProcessW` and Windows command-line parsing produces argv.
   So multi-word strings happen to work on Windows -- which makes
   the docstring misleading for Windows readers and unhelpful for
   anyone whose actual problem is portability.

2. The blanket recommendation to use `shlex.split` read as a general
   string-to-argv splitter. `shlex.split` parses POSIX shell syntax
   on all systems, and the resulting tokens are still unsafe for
   anything but fixed, fully trusted strings -- in particular,
   strings built by interpolating values can still inject extra
   arguments via embedded whitespace or quoting.

Restructure `:param command:` into four paragraphs (description,
platform-specific string handling, `shell=True` / `Git.USE_SHELL`
warning, qualified `shlex.split` note) and cross-reference
`USE_SHELL` for the long-form security discussion rather than
reproducing it.

Add a related paragraph to `:param shell:` noting `shlex.split`'s
narrow value as a transitional tool when migrating existing
string-command `shell=True` calls on Unix-like systems, with extreme
care, and cross-referencing `:param command:` for the risks.

This fixes #2146. Only documentation is changed.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

To avert the mistake of not removing `shell=True` when using it.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…rm-docs

Rewrite Git.execute() command parameter docstring per #2146

When `master` is locally absent and more than one remote has it,
`git checkout master --` fails by default even if all remotes
agree, and the script falls back to creating `master` at `HEAD`.
The reflog populated by the subsequent resets then traces `HEAD`'s
history rather than a remote `master`'s. This is harmless, because
`master` is reset to `__testing_point__` either way, but unintuitive.

Add a comment so a reader of the script does not have to discover
this from a confusing run.

This fixes #2145.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Document init script behavior with multiple master remotes

Bumps [git/ext/gitdb](https://github.com/gitpython-developers/gitdb) from `335c0f6` to `0a019a2`.
- [Release notes](https://github.com/gitpython-developers/gitdb/releases)
- [Commits](gitpython-developers/gitdb@335c0f6...0a019a2)

---
updated-dependencies:
- dependency-name: git/ext/gitdb
  dependency-version: 0a019a2e2bd73158cf8b637ad78b5d4b8f15e42e
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

…les/git/ext/gitdb-0a019a2

Bump git/ext/gitdb from `335c0f6` to `0a019a2`