[BryanFRD]

Adds the shared DCO check (FerrLabs/.github reusable-dco). Every commit of a PR needs a Signed-off-by line; fix with git rebase --signoff origin/main. Renovate signs off through the shared preset.

[ferrfleet-interne]

This uses the org's reusable DCO workflow, pinned to a SHA the way pr-title.yml does, and keeps contents: read. Because it uses pull_request and not _target, fork code never runs with secrets. Nothing blocking.

Nit: the edited event only fires when someone edits the PR title, body or base branch. A title or body edit leaves the commits unchanged, so the check runs again for nothing. A base-branch change is the exception, since it can change the commit range. Dropping edited (types: [opened, synchronize, reopened]) is fine unless retargeting PRs is common here.