security-ownership-map: fix five history and community defects

The curated security-ownership-map skill has five related correctness defects:

1. community_maintainers.py implements --half-life-days as exp(-age / half_life), so an event one half-life old has weight e^-1 instead of 0.5.
2. Author-exclusion options inspect the selected attribution identity. With committer attribution, bot-authored commits committed by a human are retained despite the documented author exclusion.
3. community_maintainers.py --include-merges can silently use a default commits.jsonl cache that already omitted merges. The minimal fix bypasses the cache only when --include-merges is requested and preserves cache precedence otherwise.
4. Included merge commits need --diff-merges=first-parent; otherwise their changed-file lists are empty or unsuitable for ownership attribution.
5. When any co-change edge survives, eligible files without surviving edges are omitted from communities and graph JSON instead of receiving singleton communities.

A tested patch is available at https://github.com/mtu-soft-matter/skills/commit/c625c9b6d3c164376579b7bc915b8eb680f8a555. The upstream repository currently disables pull requests.

Validation:

• 11 standard-library regression tests cover all five defects
• python3 -m unittest discover -s skills/.curated/security-ownership-map/tests -v
• both modified scripts pass python3 -m py_compile
• git diff --check passes