Allow co-author checks on upstream sync PRs

[sharath58]

Summary

• Exclude commits already reachable from official qm main when validating co-author trailers.
• Continue rejecting GitHub privacy addresses introduced by the pull request itself.

Why

Merge-based upstream syncs place historical upstream commits in the pull request range. A trailer policy added later should not retroactively reject commits that official qm already accepted.

Verification

• Prettier check for the workflow.
• Replayed the check against a merge-based sync range containing historical privacy-address trailers.
• Scrubbed outgoing history for organization paths, identifiers, and binaries.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}