ci: bump cla-github-action to 1ecf0d2f (impersonation guard, co-author trailers)

[iainmcgin]

Bumps the CLA assistant action from eeb7f3f (v2.7.1) to 1ecf0d2f.

What's new in the action

• Impersonation guard — new require-opener-as-author input (default true): fails the check if the PR opener is not recorded as an author or Co-authored-by of any commit in the PR. Guards against an attacker opening a PR whose commits are attributed to a trusted identity. Emits an opener_not_in_commits output regardless of pass/fail. Runs before the allowlist filter, so allowlisted maintainers are not exempt.
• PR opener and Co-authored-by: trailers join the committer set — previously only commit.author was checked. The PR submitter and any co-author trailers must now also sign (or be allowlisted). Noreply-form trailer emails (<id>+<login>@users.noreply.github.com) are parsed directly to login/id.
• Actionable unlinked-email guidance — when a commit author's email is not linked to any GitHub user, the bot now posts a > [!WARNING] block listing each unlinked email with concrete remediation (link at github.com/settings/emails, or rewrite commands).
• Dead-404-path bugfix (signatures-file bootstrap now works first-time), broken-markdown fix in the signed list, pagination for comments/runs/commits, TypeScript 6, knip/publint/actionlint.
• Removed signed-empty-commit-message input (we don't use it).

Config

Kept require-opener-as-author at the default true. No new inputs wired. Allowlist preserved verbatim.

Operational impact

• Author-rewrite for unlinked-email contributors (e.g. the recent author-rewrite on PR fix(build): skip rerun-if-changed for .files() in Buf mode #59) — still works: the contributor is the PR opener and appears via the Co-authored-by: trailer, so no opener mismatch. They are now correctly required to sign.
• Signed-squash for unsigned fork commits — the squash commit message must include Co-authored-by: <login> <id+login@users.noreply.github.com> for the PR opener, or the impersonation guard will fail the check.

Note

pull_request_target runs the workflow from the base branch, so this PR's own CLA check still uses the old eeb7f3f pin. The new action is first exercised on the next PR opened/synced after this merges.

Fixes #72