build: enforce DCO sign-off on pull requests

[kperry-godaddy]

Adopt Developer Certificate of Origin (DCO) sign-off, following the Linux Foundation contribution model.

• Every human-authored commit in a PR must carry a Signed-off-by: trailer certifying the DCO (git commit -s).
• Enforcement: the org-wide DCO app — the LF/CNCF standard — which validates sign-offs per commit and exempts bot-authored commits (Dependabot, release-please) and merges. No per-repo workflow needed.
• CONTRIBUTING.md documents DCO, AI-assistance disclosure per the kernel convention, and issue-linking.
• Follow-up once the app is installed org-wide: make DCO a required status check on main.

Note: existing open PRs will need git rebase --signoff (or a squash-merge with a signed-off message) once the check becomes required.