governance: adopt DCO sign-off + flip CONTRIBUTING external-PR policy when the merge window opens

[thinmintdev]

What to build

Decision (audit Q6.3): adopt DCO sign-off (git commit -s / Signed-off-by), not a CLA. When you open the external-PR merge window, flip the CONTRIBUTING.md "external PRs aren't merged" line and document the DCO requirement (optionally add a DCO status check/bot).

HITL: the timing is the maintainer's call — open the window when ready.

Pointers: CONTRIBUTING.md. Audit Q6.3.

Acceptance criteria

• CONTRIBUTING.md documents the DCO sign-off requirement
• The "no external PRs" line is flipped when the merge window opens
• (optional) DCO status check enabled

Blocked by

• repo: add CODE_OF_CONDUCT.md (Contributor Covenant) + SECURITY.md at root #629 (CODE_OF_CONDUCT.md + SECURITY.md exist)