Adopt DCO and contribution provenance rules

[KeyffMS]

What changed

• adopt the Developer Certificate of Origin 1.1 workflow instead of a CLA;
• require a Signed-off-by trailer on every human-authored pull-request commit;
• add a dedicated DCO status check that does not build or run the application;
• define employer/client authorization, third-party disclosure and AI-assisted contribution rules;
• prohibit material with unknown or incompatible provenance/licensing;
• add a pull-request provenance checklist and a public exception register;
• document the historical review through PR Complete privacy and support-data policy #130, which identified no independently authored merged contribution requiring retroactive permission evidence.

Scope

Contribution governance only. The application and its tests are unchanged.

Closes #87.