Adopt the Developer Certificate of Origin for all commits

Every commit must now carry a Signed-off-by trailer matching its
author, certifying the right to submit the change under the project's
MIT license (DCO 1.1, the Linux kernel mechanism). Enforcement is
strict at three layers: a commit-msg hook rejects unsigned commits
locally (scripts/install-git-hooks.sh), and the new DCO workflow
rejects every push and pull request containing one. Merge commits and
bot authors are exempt, matching standard DCO checks.

Signed-off-by: Martin Vogel <martin.vogel@datadice.io>

scripts/git-hooks/commit-msg

@@ -0,0 +1,18 @@
+#!/bin/sh
+# commit-msg hook — STRICT DCO enforcement at commit time.
+# Every commit must carry a Signed-off-by trailer (git commit -s).
+# Install with: scripts/install-git-hooks.sh
+
+if grep -qE '^Signed-off-by: .+ <.+@.+>' "$1"; then
+    exit 0
+fi
+
+echo "" >&2
+echo "COMMIT REJECTED: missing Signed-off-by trailer (Developer Certificate of Origin)." >&2
+echo "" >&2
+echo "  Sign your commit:        git commit -s" >&2
+echo "  Fix the last commit:     git commit --amend -s" >&2
+echo "" >&2
+echo "The sign-off certifies you have the right to submit this code under the" >&2
+echo "project's MIT license — see the DCO file and CONTRIBUTING.md." >&2
+exit 1