Verify DCO for every commit in an applied patch series

## Problem

`tools/verify_patch.sh` applies patches with `git am`, but checks DCO only with `git log -1`. For a multi-commit patch series, an unsigned earlier commit can pass verification when the final commit contains a `Signed-off-by:` trailer.

`CONTRIBUTING.md` requires every commit to include the DCO sign-off and allows patch series, so the verifier should enforce that rule for the complete applied range.

## Scope

Update `tools/verify_patch.sh` to check every commit introduced by the patch application instead of only the final commit. Keep the current single-patch behavior and existing verification commands unchanged.

Add an isolated regression test using a temporary Git repository.

## Completion criteria

- [ ] A signed single patch still passes DCO verification.
- [ ] A fully signed multi-commit patch series passes.
- [ ] A series with any unsigned commit fails even when the final commit is signed.
- [ ] Failure output identifies the offending commit or commits.
- [ ] The focused test does not require a Wave compiler, LLVM, or network access.

Related: #639