ci(dco): ask for a sign-off on authored commits, not on merge commits

[frahlg]

Summary

Not a driver change — this removes the deadlock that stopped #65 from merging
and would have caught the next fork pull request just the same.

Branch protection requires a pull request to be up to date with main before it
merges. The merge commit GitHub's Update branch button writes carries no
Signed-off-by trailer, and dco counted it. So bringing a stale pull request
up to date was the very act that made it unmergeable.

There is no way out from inside that rule. Fixing it means force-pushing a
trailer onto a commit the contributor did not write, and when the pull request
comes from a fork this repository cannot push to, nobody who can merge can also
do that. It deadlocked #65 — which had to be relanded as #83 to carry a one-line
trailer — and a0d5d73 on that same branch before it.

git rev-list gains --no-merges. A sign-off certifies authored content; a
merge commit from the update button carries none, so the check now asks for the
trailer on the commits that do. That is the line the upstream DCO app draws too.
The failure message also now names the two commands that fix a genuine miss.

The trade-off, stated plainly: a conflict resolved inside a merge commit is
content this check no longer sees. The reviewable content still arrives on the
authored commits either side of it, and every other check in the suite still
runs against the merged tree.

Driver evidence

• Driver id: not applicable — CI configuration only, no driver, manifest or
  catalog file is touched
• Device make/model: not applicable
• Firmware tested: not applicable
• Protocol/register source: not applicable
• Hardware test performed: not applicable
• Known limits: as stated in the trade-off above

Safety

• The driver starts read-only, or this is a separately reviewed control change. — no driver changes
• Vendor signs are converted at the driver boundary. — not applicable
• Cached telemetry becomes stale instead of being re-emitted as fresh. — not applicable
• No credentials, serial numbers, private addresses or site data are included.

Package or promotion evidence

not applicable — no package version, target, control contract or release
candidate changes, and no artifact bytes move.

Checks

• Commits include Signed-off-by.
• Verified against the exact range that failed on make the signed artifact agree that myuplink is read-only #65
  (4fb8608..01da267): it fails under the old rule and passes under the new
  one.
• Verified a genuine violation is still caught: an authored commit with no
  trailer fails, including when a merge commit sits in the same range.
• validate.yml parses; all six jobs intact.

---

Generated by Claude Code