Adopt a Contributor License Agreement (CLA) or DCO for contributions

## Summary

Contributions to the project are accepted without any Developer Certificate of Origin (DCO) sign-off or Contributor License Agreement (CLA), and this isn't mentioned in [CONTRIBUTING.md](../blob/main/CONTRIBUTING.md).

## Current state

- `CONTRIBUTING.md` describes the fork/branch/PR workflow, coding style, and testing expectations, but says nothing about IP provenance of contributions.
- There is no DCO bot, no CLA-assistant GitHub Action, and no `.github/` config enforcing sign-off on commits.
- The project has a long history of external, one-off contributions (many closed issues are labeled `hacktoberfest`, `help wanted`, `good first issue`), which is great for community growth but means the codebase has provenance from a large number of individual contributors with no recorded, explicit license grant beyond "this is an MIT-licensed repo they opened a PR against."

## Why this matters

Organizations that run legal/IP due diligence on open-source dependencies (common for anything pulled into a commercial codebase) often check whether a project has a documented process establishing that contributors have the right to submit their contributions under the project's license, and that this is explicitly recorded. A DCO (lightweight: a sign-off line on each commit, `git commit -s`) is the most common minimal-friction way to establish this trail without requiring contributors to sign a separate legal document; a full CLA is heavier-weight but gives stronger guarantees.

## Suggested resolution

- Add a DCO requirement (simplest option): enable a DCO check (e.g. the `dcoapp/app` GitHub App or `.github/workflows` DCO action) that requires `Signed-off-by` on each commit, and document `git commit -s` in CONTRIBUTING.md.
- Alternatively, adopt a lightweight CLA via a CLA-assistant bot if stronger guarantees are desired.
- Document whichever approach is chosen in `CONTRIBUTING.md` so new contributors see it upfront.

## Acceptance criteria

- [ ] A DCO or CLA check runs on incoming PRs.
- [ ] CONTRIBUTING.md documents the requirement and how to satisfy it.

The issue is about updating CONTRIBUTING.md and setting up a DCO or CLA process. Start by reading the existing CONTRIBUTING.md file to understand the current workflow. Research GitHub Apps like DCO app or CLA assistant to understand integration. The work involves editing documentation and potentially configuring GitHub Actions or app settings, which requires understanding of project contribution workflows and legal considerations.

Written by the indexing model from the issue text.