fix: dco merge skip, dependabot docs, token perms tightening + rebase helper for best scorecard

[SebTardif]

Summary

Implements all the safe improvements discussed for Dependabot friction while explicitly protecting (and documenting how to protect) the best possible OpenSSF Scorecard.

Changes:

• DCO: skip merge commits in addition to [bot] authors (transient only because of squash-merge policy).
• AGENTS.md: new "Handling Dependabot PRs" section with exact commands, rationale tied to current Scorecard numbers (CI-Tests=10, Branch-Protection, Token-Permissions, Dependency-Update-Tool=10).
• Token-Permissions: explicit minimal job-level perms + comments on the four workflows flagged in recent scans (auto-approve, dependabot-auto-merge, backport, sign-old-releases).
• New scripts/rebase-dependabot.sh (shellcheck clean) — the low-risk canonical helper.
• Updated workflow NOTES to cross-reference the guidance.

No risky changes were made:

• No re-introduction of the auto-rebase job (known to invalidate CI runs and hurt CI-Tests).
• No additional skipping of tests/linters for Dependabot PRs (would regress CI-Tests=10).
• Branch-Protection "up-to-date branches" and full CI expectations remain intact.

Scorecard impact

All changes are neutral-to-positive for the checks that matter:

• CI-Tests stays at 10 (fresh runs after clean rebases).
• Branch-Protection hygiene preserved/enhanced via docs.
• Token-Permissions warnings addressed at source.
• DCO relaxation is narrowly scoped to merge commits we already discard on squash (consistent with existing bot exemption).

How to review

• The rebase helper + docs should make future chore(deps): Bump github.com/prometheus/common from 0.68.1 to 0.69.0 in the go-minor group #348/chore(deps): Bump the actions group with 3 updates #349 style incidents rare.
• Run scripts/rebase-dependabot.sh --help (or just read it).
• The DCO change was tested for syntax + logic.

See commit for full details.

Closes the recurring babysitting pattern for Dependabot while aiming for Scorecard 10.

[SebTardif]

Rebased cleanly onto latest main (conflicts were only in the evolved auto-approve.yaml permissions block; resolved by combining current logic with our Token-Permissions tightening comment).

• mergeable: MERGEABLE now
• New CI runs queued on the rebased commit (f678701)
• All our changes (DCO merge-commit skip, AGENTS.md guidance + rebase helper script, permission scoping/comments for Scorecard, updates to related workflows) are on top of current main.

No reviews yet. This should unblock the Dependabot babysitting issues long-term while keeping high Scorecard (CI-Tests, Branch-Protection, Token-Permissions).

Let me know if any adjustments needed!