Require author-matching DCO sign-offs on pull requests

[kwisatzh]

Summary

• Check every PR commit for a final Signed-off-by trailer matching its author name and email.
• Use read-only API access, pinned actions, and no checkout in the enforcement job.
• Exempt only verified GitHub branch-update merges; reject incomplete or changing commit lists.
• Report each failing commit and the signed repair commands.

Validation

• 64 local sign-off, API failure, pagination, and merge-exemption tests passed.
• Workflow lint passed.
• The separate read-only test job exercises the same inline workflow code.

No application behavior changes. All commits are signed and signed off. The exact-match rule also applies to bot commits; a mismatched Dependabot author email and trailer will fail.