governance: enforce DCO and document continuity checks

[TFT444]

Summary

Implements the repository-controlled parts of #205.

• adopts DCO 1.1 as the contribution authorization mechanism
• adds a dependency-free PR check requiring a valid Signed-off-by trailer on every introduced commit
• documents contributor sign-off and repair instructions
• adds the DCO requirement to the pull request checklist
• adds an owner-verifiable continuity capability matrix and six-month review process
• adds regression tests for valid, missing, malformed, and mixed commit sign-offs

Validation

• 3 DCO helper tests pass
• this PR commit passes the new DCO checker
• Ruff and formatting pass
• workflow YAML parses successfully
• git diff --check passes

Owner confirmation still required

Issue #205 must remain open until an organization owner privately verifies that at least two people can administer issues, merge approved work, publish/recover releases, and recover critical organization/deployment access. Documentation cannot prove that underlying access state.

Advances #205

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	34e114876b0b11c390a56381ad16ebd13914f8d5	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 20 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches

Scanned Files

• .github/workflows/dco.yml

[m-khan-97]

The DCO tooling itself is clean — check_dco.py uses subprocess with list args (no shell injection), reads messages via git show --format=%B, and the regex requires a real name + bracketed email. Tests cover the happy path and malformed trailers. Good, small, well-scoped.

One blocking issue: the check will fail on merge commits.

commits_between() runs git rev-list --reverse BASE..HEAD with no --no-merges, so every commit in the PR range is checked — including merge commits. A git merge origin/dev merge commit has the default message ("Merge remote-tracking branch 'origin/dev'…") with no Signed-off-by, so it fails the check.

This isn't hypothetical: TFT444 merged dev into #161 twice during that PR's review cycle. With this workflow active, those merge commits would have hard-failed the DCO gate, blocking a legitimate PR through no fault of the author's own commits. The standard GitHub DCO app skips merge commits for exactly this reason.

Fix is one line — add --no-merges to the rev-list (and ideally a test asserting a merge commit is skipped). Alternatively, if the team wants to standardize on rebase-only (no merge commits in PRs), that's fine too, but then it should be documented in docs/dco.md so contributors know not to git merge dev.

Non-blocking: heads-up that this makes DCO a required check for everyone going forward — the team (and I, on #188) haven't been using git commit -s, so everyone will need to adopt it. Worth a Discord note when this lands. The docs/dco.md amend/rebase instructions are good for that.

Happy to approve once merge commits are handled.