Harden contribution provenance and GOVP/QEL IP boundary

[enekosz]

Summary

• records the open GOVP / proprietary QEL boundary and Apache-2.0 patent-publication risk
• requires DCO sign-off for every non-Dependabot PR commit
• requires a verified employment assignment or contributor/corporate IP agreement before code merge
• adds patent-sensitive publication and third-party provenance checks to the PR process

Validation

• 100 tests passed locally
• GOVP self-test passed
• YAML parsed and git diff check passed

Governance note

This PR intentionally does not claim that a DCO transfers copyright. The executed assignment/agreement remains an out-of-band maintainer gate. Legal counsel should review the final contributor agreement form before accepting external code.