[BryanFRD]

Adds the shared DCO check (FerrLabs/.github reusable-dco). Every commit of a PR needs a Signed-off-by line; fix with git rebase --signoff origin/main. Renovate signs off through the shared preset.

[ferrfleet-interne]

Calls the org reusable DCO workflow pinned by SHA, with least-privilege permissions. The reusable job checks origin/<base>..head with no merges, and this PR's own commit is signed off. Nothing blocking.

Nit: edited only fires on title/body/base changes. Title and body can't change the commit list, so those reruns do nothing. Only a base-branch change matters here. Keeping edited is harmless (the reusable workflow's concurrency group cancels overlapping runs), but [opened, synchronize, reopened] would be enough unless you want base retargets covered.