fix(ci): apply DCO enforcement baseline

[TFT444]

Summary

Fixes false DCO failures caused by historical commits predating enforcement, especially on squash-based dev to main release pull requests.

• subtracts the ancestry of the explicit PR governance: enforce DCO and document continuity checks #208 DCO baseline from the PR commit range
• continues checking new work from branches created before the baseline
• preserves merge-commit exclusion
• treats an all-exempt range as successful
• documents the cutoff and adds real Git-history regression coverage

Validation

• 6 passed in ests/test_dco_check.py
• Ruff lint and format checks pass
• DCO workflow YAML parses successfully
• replay of PR Security fixes: cryptography CVE-2026-69247 and other dependency patches #227 base/head SHAs passes and verifies the one post-policy commit

Closes #231

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[TFT444]

@Vishnu2707 I found and fixed an additional edge case: legacy commits on an unmerged side branch are now grandfathered by timestamp, while every commit created after DCO was introduced is still enforced. This was validated against the old #227 failure range and PR #198's history; all checks are green. Please review and merge #232 first so I can finish updating #198 without false DCO failures.

[Vishnu2707]

Approved.

[Vishnu2707]

@TFT444 , you can work on updating #198