legal: enforce CLA + credit contributors (attribution, not ownership)

[bkd-dotcom]

Brings this repo in line with the platform model: contributors can help and are credited, but cannot use/sell/rebrand it as their own.

• CLA gate (contributor-assistant bot, in-repo, no external OAuth) blocks PRs until signed.
• CLA.md — copyright assignment + 'Recognition of Contributors' (credit is attribution only, no rights).
• CONTRIBUTORS.md — credit file (credit ≠ ownership).
• CONTRIBUTING.md — CLA sign step + Credit section.

Matches umbra-core. Not legal advice.

[github-actions]

Umbra Reviewer — 🔴 Block

Blocked — 2 blocking finding(s): Workflow uses pull_request_target, Workflow uses pull_request_target · a forbidden CI permission/OIDC change. Not mergeable until resolved.

Deterministic gates (the authority)

Gate	Status
Required status check	— unknown
Secret scan	✅ clean
CI permission / OIDC	❌ no forbidden change
Dependency skew	✅ ok
All green	❌

Findings (4, 2 blocking)

• 🟠 Workflow uses pull_request_target [blocking] .github/workflows/cla.yml:15
  • pull_request_target runs with the base repo's secrets while checking out untrusted PR code — a classic exfiltration vector if it checks out and runs the PR head.
  • Fix: Avoid running untrusted code under pull_request_target; if unavoidable, never checkout PR head with secrets present.
• 🟠 Workflow uses pull_request_target [blocking] .github/workflows/cla.yml:30
  • pull_request_target runs with the base repo's secrets while checking out untrusted PR code — a classic exfiltration vector if it checks out and runs the PR head.
  • Fix: Avoid running untrusted code under pull_request_target; if unavoidable, never checkout PR head with secrets present.
• 🟡 Third-party action not pinned to a SHA: contributor-assistant/github-action@v2.6.1 .github/workflows/cla.yml:31
  • A third-party action pinned to a tag/branch can be moved to malicious code without changing the ref. Pin to a full commit SHA.
  • Fix: Pin as contributor-assistant/github-action@<40-char-commit-sha>.
• 🟡 Change touches a protected path: .github/workflows/cla.yml .github/workflows/cla.yml (via cross-check)
  • .github/workflows/cla.yml matches a protected pattern (.github/workflows/*). Changes here alter shared/foundational surface and warrant a designated reviewer.
  • Fix: Route to a code owner / architecture reviewer.

Sensitive surface

This PR changes security-sensitive paths that warrant a designated reviewer:

• .github/workflows/cla.yml

Merge

Do not merge until the blocking items above are resolved.

This review is advisory. It never merges on its own judgement — the deterministic gates + a human are the authority. Findings can have false negatives; a green bot verdict is not a guarantee.