proposal: adopt DCO (Developer Certificate of Origin) for contributions #2575

Apache 2.0's inbound-equals-outbound model (§5) gives the project legal cover by default, but lightweight per-commit attestation reduces risk for any future relicensing or audit.

Proposal: require Signed-off-by: on commits via the DCO GitHub App rather than running a CLA service.

Why DCO over a full CLA:

• Lightweight — no separate web form, no signature service to operate.
• GitHub-native — DCO App checks every PR commit for Signed-off-by:.
• Lower contributor friction than Apache ICLA (just git commit -s).
• Used by Linux kernel, Docker, GitLab, Kubernetes-adjacent projects.

Why not full CLA:

• Requires Anthropic-style infrastructure (or CLA Assistant) to operate.
• Higher friction discourages drive-by contributions.
• Apache 2.0 §5 already covers inbound contributions.

Tradeoffs:

• DCO doesn't grant assignment, so a future relicense still requires contributor consent. (Acceptable — relicensing isn't planned.)
• Old PRs from before adoption need a one-time signoff sweep or grandfathering policy.

Tasks:

• Install DCO GitHub App on wheels-dev/wheels
• Add CONTRIBUTING.md section on git commit -s
• Update PR template (.github/pull_request_template.md) to mention the requirement
• Decide on bot-authored commit handling — wheels-bot commits would need Signed-off-by: wheels-bot <noreply@github.com> in .claude/commands/_shared-rails.md
• Grandfather all existing commits; enforce on new PRs only

Optional / nice-to-have. Lower priority than the visible-inconsistency fixes (landing page, cli/LICENSE).