Adopt the Developer Certificate of Origin #1545

The project accepts contributions under the MIT license through pull requests and asks for no Developer Certificate of Origin. The OpenSSF Best Practices silver criterion dco (SHOULD) asks for a way to show that contributors are legally authorized to make their contributions, and names the DCO as the usual one. An unmet SHOULD with a justification is accepted for silver, so this is a decision rather than a gap: adopting it binds every commit, the maintainer's included.

If adopted

• CONTRIBUTING.md: a "Developer Certificate of Origin" section linking https://developercertificate.org/, saying what Signed-off-by means here and asking for git commit -s.
• .github/pull_request_template.md: a checkbox.
• A CI check, written as a Go command per the repository tooling rule, that fails a pull request with a commit whose Signed-off-by does not match its author. A squash merge takes the pull request description as the commit message, so the check also decides whether the description carries the trailer that reaches main.
• The repository setting that requires sign-off on commits made in the web interface (web_commit_signoff_required).
• CLAUDE.md: the rule and a link.

Done when

• A pull request with an unsigned commit fails the check and a signed one passes, or this issue records why the project does not adopt it.