Harden DCO identity checks and contribution provenance

[KeyffMS]

Scope

Harden the repository-owned DCO and contribution-provenance controls for Issue #87.

What changed

• replace the spoofable [bot] author-name/email exception with an exact trusted bot allowlist;
• bind each accepted Signed-off-by trailer to the commit author or committer identity;
• require trusted bot exceptions to match the pull-request actor login, numeric GitHub ID, account type and exact commit emails;
• keep the production bot allowlist empty by default;
• add policy tests covering signed, unsigned, mismatched-signoff, spoofed-bot, trusted-bot and wrong-actor-ID cases;
• run the policy fixtures and actual pull-request verification from the Verify commit sign-offs job;
• document exact main branch protection requirements, prohibited standing bypasses and evidence requirements;
• update DCO, contributor-provenance and exception policies.

Repository-setting boundary

The repository integration used for this implementation can modify repository files, workflows, Issues and pull requests, but it does not expose branch-protection or repository-ruleset mutation/read actions. This PR therefore does not claim that GitHub settings have already been changed. After the code merges, #87 remains open until the main ruleset is applied and verified through GitHub administration settings.

Provenance and licensing

• Every human-authored commit has a valid Signed-off-by trailer under DCO.md.
• I created this contribution or am authorized to submit it for distribution under the repository's MIT License.
• I disclosed copied/adapted code, snippets, templates, media, data and generated assets below.
• I identified the source and license of every third-party element.
• I am authorized to contribute work created for an employer, client or other rights holder, where applicable.
• I disclosed material AI assistance and performed human review/provenance verification below.
• This contribution does not include material with unknown, incompatible or non-redistributable terms.

Third-party material

None. The implementation uses standard Bash, Git and jq behavior already available on GitHub-hosted Ubuntu runners.

Employer/client authorization

Not applicable. Repository owner KeyffMS directed the implementation.

AI assistance

OpenAI ChatGPT assisted with drafting the workflow, scripts and documentation. The change is constrained to repository governance, and the executable policy is validated by dedicated fixtures and GitHub Actions.

Exceptions or private permissions

None. The production bot allowlist is empty.

Validation

• DCO policy fixtures run inside the DCO workflow;
• the new verifier checks all commits in this pull request;
• the normal Windows build/test workflow remains unchanged and must pass.

Addresses #87.