Verify claimed artifact ownership via commit authors, not repo names

When a bio credits someone with an open-source project, do not treat a matching org/repo name as proof. Hit /repos/{org}/{repo}/contributors and /commits and aggregate commit.author.name+email: a repo whose name matches the company can be an unrelated same-name project with zero commits from anyone at that company. Same trick in reverse for exec roles — SEC EDGAR Form D primary_doc.xml has a relatedPersonInfo block listing executive officers and directors by name, so you can check whether a claimed co-founder/CTO actually appears on the filing (absence is not disproof, but it flags claims that rest only on self-report). Also worth knowing: GitHub release download_count sums are dominated by electron-updater manifest files (latest.yml, latest-arm64-mac.yml) that every installed client re-polls — filter to actual installer extensions or you will overstate installs by 10-15x.