Prefer using IdentityQuery, mostly just so the rules end up consistent if we add view policy stuff later, and sometimes we start doing implicit attachment or weird filtering or whatever.

(The guidance is roughly "use Query if it exists".)

Prefer PeopleQuery, per above.

At least for now, allowing $author to = null may avoid some issue: for example, installs that haven't run rebuild-identities yet won't get an Author identity for older commits and will try to attach null, I think.

Consider removing the boolean flag and just using hasEffectiveUser() at callsites -- this is a little more standard/readable, and getEffectiveUser(false) can be a little hard to guess the meaning of.