docs: push-check brief amendment 1, binary detection adds a NUL scan of the committed blob so attributes can't hide a binary, and an unconfirmed queue tail fails closed (dewey-0955, row 327); doc only

docs/plans/2026-10-24_push-guard-binary-manifest.md

@@ -101,3 +101,13 @@ if git log --format=%B "$BASE..$SHA" | grep -iqE 'co-authored-by|generated with'
 echo NO_ATTRIBUTION
 echo "PUSH_READY $BASE..$SHA"
 ```
+
+### Amendment 1 (Dewey's landing review, dewey-0955)
+
+`git diff --numstat` follows git attributes, so a `diff` attribute (from the tree's `.gitattributes`,
+`.git/info/attributes` or `core.attributesFile`) can make a binary blob count as text. Item 2 changes.
+A path is binary when numstat marks it binary, or when it exists at SHA and its blob (`git cat-file
+blob SHA:path`) has a NUL byte in its first 8000 bytes, git's own rule. Attributes can add binaries
+but never remove them. Tests add scratch cases for each of the three attribute sources, each with no
+`--row` and each expecting `STOP binary`. A sixth mutant drops the NUL scan. Also, when the queue read
+returns code 0 with an unconfirmed-tail note, the check stops (fail closed), with a test.