[anHappyDog]

Summary

Require Conventional Commits 1.0 subjects and DCO 1.1 sign-offs for every commit introduced by a PR, plus a compliant PR title. Document the categories, optional scopes, breaking-change markers, 72-character subject limit, message layout, author/coauthor identity matching, and repair commands in the contribution guide and PR checklist.

Add one lightweight Commit policy job using only Python's standard library and Git. It checks the event's actual base/head range, including contributor-authored merges, and uses Git's trailer parser so a sign-off buried in prose does not pass. PR edits rerun this check; existing CPU/lint/docs workflows and the path-filtered Recipe jobs are unchanged. Existing main history and GitHub's temporary test-merge commit are excluded.

Verification

• .venv/bin/pytest -q tests/test_commit_policy.py: 20 passed, using real temporary Git histories. Covers unsigned earlier commits, mismatched/malformed/nonterminal sign-offs, coauthors, authored merges, invalid subjects/body layout, event head/title handling, and invalid/empty ranges.
• .venv/bin/ruff check scripts/check_commit_policy.py tests/test_commit_policy.py: passed.
• .venv/bin/ruff format --check scripts/check_commit_policy.py tests/test_commit_policy.py: passed.
• mkdocs build --strict: passed.
• git diff --check: passed.
• GitHub CI: 1080 passed, 45 skipped; lint and strict EN/ZH documentation builds passed.
• Live negative title check: an invalid PR title failed as expected; restoring the compliant title passed. Title edits triggered only the lightweight policy workflow.

Enforcement and rollout

Main's branch protection now requires Commit policy from the GitHub Actions app. Its existing two-review requirement, stale-review dismissal, and enforcement for administrators are preserved. This new check does not add a requirement for branches to be up to date.

Merge this PR to make the policy workflow available to other PRs. Existing PRs must trigger a new policy run (for example, by updating their branch or reopening the PR) and fix any violations; merged main history is not rewritten or retroactively signed off.

Maintainers must retain DCO trailers and use compliant messages when squashing, rebasing, or creating final merge commits; the PR job cannot inspect a future GitHub-generated merge commit.

Checklist

• PR title and introduced commits follow the documented policy and have author DCO sign-offs.
• Contribution is licensed under Apache-2.0.
• Runtime code, robot dependencies, and pinned third-party sources are unchanged.