Guard the DCO range against a branch's first push, and add the governance files

[HackTuah]

Two commits. The first carries a demonstrated red.

61d1b30 — guard the DCO range

The DCO job failed on its own first run, and the commits were fine:

fatal: Invalid revision range 0000000000000000000000000000000000000000..HEAD
cannot resolve 0000000000000000000000000000000000000000..HEAD
Process completed with exit code 1

github.event.before is the all-zeros SHA on a branch's first push, because there is no previous state to name. before..HEAD is then not a range, and the job exited before looking at a single commit.

That failing run is the red, and it is the point of having pushed an unproven workflow: a check that has never run is a claim, and its first run is what turns it into a measurement. This one found a defect in itself.

Guarded as the sibling tree guards the same case, with a stricter fallback — that tree checks one commit (sha~1..sha); on a first push every commit reachable from HEAD is new to the remote, so all of them are in scope here. Simulated on both branches before pushing:

all-zeros (first push)   commits in scope: 8    all signed off: yes
ordinary push            commits in scope: 1    all signed off: yes

The job now also prints how many commits it examined, so a run that checks nothing cannot read as a run that found nothing — which is exactly how the original defect hid.

39834d1 — SECURITY.md, CONTRIBUTING.md, dependabot.yml

SECURITY.md states a response commitment one maintainer can keep: acknowledgement within 7 days, an assessment within 30, credit in the advisory, no bounty and no guaranteed fix deadline. A 24-hour turnaround would read better and would be a promise this project cannot honour. It also tells a reporter what to do if nothing comes back.

Scope is drawn at the package boundary — protocol handling, framing and bounds, schema validation, era confusion, disclosure across the wire. Out of scope is what a host's tools do: this package validates and routes, it does not execute.

CONTRIBUTING.md states four enforced rules — DCO sign-off, no tool-attribution trailers, a green gate with no baseline, rebase-only — and names what enforces each.

dependabot.yml covers mix and github-actions weekly. The workflow pins erlef/setup-beam@v1 and actions/checkout@v4, which drift without something watching them.

Not in this PR

The inspect/1 wire-error fix has moved to its own PR, as it is an unrelated change to server.ex.

Note

This branch exists because a repository ruleset now requires pull requests and two checks. It was applied after the first push, and direct pushes to main are correctly refused.