docs: adopt the no-CLA plus DCO policy and fix copyright terms

Brings the server in line with the contribution and copyright policy
already adopted in pgsty/mc.

Copyright terms were derived from the clock: startupBanner overwrote the
ldflags-injected CopyrightYear with time.Now().Year() and printed it as
the end of MinIO, Inc.'s term, so every January would have extended the
upstream copyright claim past the 2025 end of upstream development, and
release builds silently discarded the injected year. Both banners now
credit MinIO, Inc. for 2015-2025 and PGSTY from 2025 through the
release-stamped year, falling back to the current year in source builds.
NOTICE names PGSTY as the holder of the fork's modifications, matching
the banners and the packaging vendor field.

Contributions are accepted inbound=outbound under AGPL-3.0-or-later with
no CLA - the core is Copyright MinIO, Inc., so the combined work can
never be relicensed and a CLA would buy nothing. What a fork carrying a
downstream delta does need is provenance, so DCO 1.1 sign-off is now
mandatory and enforced by a workflow that rejects unsigned non-bot
commits. CONTRIBUTING documents sign-off, repair, cherry-pick provenance,
dual copyright headers, trailer preservation across squash merges, and
that assistive-tooling trailers carry no authorship or copyright claim.

verify-rebrand.sh pins the copyright split and the policy files so
neither can regress.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Feng Ruohang <rh@vonng.com>

CONTRIBUTING.md

@@ -51,10 +51,11 @@ Before opening a pull request:
 
 ### Commit changes
 
-After verification, commit your changes with a concise message:
+After verification, commit your changes with a concise message and a DCO
+sign-off (see [Licensing of Contributions](#licensing-of-contributions)):
 
 ```
-git commit -am 'Fix object replication retry handling'
+git commit -s -am 'Fix object replication retry handling'
 ```
 
 ### Push to the branch
@@ -72,6 +73,60 @@ test evidence, compatibility notes, and documentation impact. Public product
 documentation is owned by the separate
 [`pgsty/silo.pgsty.com`](https://github.com/pgsty/silo.pgsty.com) repository.
 
+## Licensing of Contributions
+
+Silo is licensed under the [GNU AGPL v3.0 or later](LICENSE). Its core is
+Copyright (c) MinIO, Inc.; the combined work can never be relicensed, and this
+fork does not try to.
+
+* **No CLA.** We do not ask you to sign a Contributor License Agreement and we
+  do not take your copyright. Contributions are accepted inbound=outbound: you
+  keep the copyright to your changes and license them under the same
+  AGPL-3.0-or-later as the project itself. The maintainers receive no rights
+  beyond the project license.
+
+* **DCO sign-off required.** Every commit must carry a
+  `Signed-off-by: Your Name <you@example.com>` trailer certifying the
+  [Developer Certificate of Origin 1.1](https://developercertificate.org/) —
+  your statement that you have the right to submit the code under the project
+  license. Sign each commit with:
+
+  ```
+  git commit -s
+  ```
+
+  Forgot some? Repair your branch with `git rebase --signoff` and force-push.
+  CI rejects pull requests containing unsigned commits; the sign-off email
+  must match the commit author email. (Lowercase `-s` is the plain-text DCO
+  sign-off; cryptographic `-S`/GPG signing is welcome but independent.)
+
+* **Provenance.** Only submit code you are entitled to submit. This matters
+  more here than in most projects: Silo carries a downstream delta over an
+  upstream code base, and cherry-picks from the lineage remote or other forks
+  are routine. When relaying a patch written by someone else, preserve original
+  authorship (`git cherry-pick -x`, keep the author field and any existing
+  `Signed-off-by` trailers) and add your own sign-off as the person passing it
+  along. Never import code from a proprietary distribution.
+
+* **File headers.** Files derived from upstream keep the original MinIO
+  copyright header unchanged. New files added by this fork use the dual
+  header, followed by the standard AGPL boilerplate:
+
+  ```
+  // Copyright (c) 2015-2025 MinIO, Inc.
+  // Copyright (c) 2025-2026 PGSTY
+  ```
+
+* **Squash merges** must keep the `Signed-off-by:` trailers in the resulting
+  commit message.
+
+* **Authorship and tooling.** The human contributor is the author of the commit
+  and the sole signatory of its DCO sign-off. Attribution trailers for
+  assistive tooling (for example `Co-Authored-By:` naming an AI assistant) are
+  informational only: they record which tools were used, and do not create
+  authorship, co-authorship, or any copyright claim. Whoever signs off remains
+  responsible for the content of the commit, whatever produced it.
+
 ## FAQs
 
 ### How does Silo manage dependencies?