chore: add local DCO check via pre-commit commit-msg hook

.pre-commit-config.yaml

@@ -1,6 +1,15 @@
+default_install_hook_types: [pre-commit, commit-msg]
 exclude: ^(scratchpad/)
 
 repos:
+  - repo: local
+    hooks:
+      - id: dco-check
+        name: DCO sign-off check
+        entry: "bash -c 'grep -q \"^Signed-off-by: \" \"$1\" || { echo \"Missing Signed-off-by trailer. Use: git commit -s\"; exit 1; }' --"
+        language: system
+        stages: [commit-msg]
+
   - repo: local
     hooks:
       # Moving ruff hooks to the local version allows for different behavior locally and in ci/cd pipelines.

CONTRIBUTING.md

@@ -302,6 +302,9 @@ Use your real name and a reachable email. PRs with unsigned commits will be bloc
 by the DCO check until every commit is signed off. To retroactively sign existing
 commits, use `git rebase --signoff <base>` and force-push.
 
+The repo's pre-commit config also runs a local DCO check at `commit-msg` time, so
+unsigned commits fail before they're pushed.
+
 <details>
 <summary>Developer Certificate of Origin v1.1 (full text)</summary>