DCO over CLA, pseudonymous sign-off accepted

Developer Certificate of Origin v1.1 at DCO; every commit signed off; CI gate 8 checks it with a script rather than a third-party app, so the gate has no dependency the repository does not control. Pseudonymous sign-offs are accepted deliberately: Apache-2.0 §5 is the primary rights mechanism, and a CLA would buy little against anonymous contributors while costing every one of them a barrier.