Add DCO (Developer Certificate of Origin) sign-off requirement

[Haz3-jolt]

Summary

Require DCO sign-off on all commits to protect the project legally under Apache 2.0.

Tasks

• Document the DCO requirement in CONTRIBUTING.md
• Add a .github/workflows/dco.yml check (or use the DCO GitHub App)
• Add Signed-off-by instructions to the PR template
• Consider adding a CLA bot as an alternative (heavier, but some projects prefer it)

Why

Apache 2.0 includes a patent grant. DCO ensures every contributor explicitly agrees their contribution is their own and licensed under the project's license. Standard practice for Apache-licensed OSS.

References

• https://developercertificate.org/
• https://github.com/apps/dco