ci: Renovate-only with signed commits + enforced DCO

Remove .github/dependabot.yml (Dependabot cannot reliably sign commits;
required_signatures has no bot exemption) and add the DCO reusable as the
enforced sign-off gate (dependency bots exempt). Renovate signs via the
shared renovate-config platformCommit. Prepares main for required signed
commits + required DCO.

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>

Author: CybotTM

.github/dependabot.yml

@@ -0,0 +1,18 @@
+name: DCO
+
+# Enforced sign-off gate via the shared reusable (dependency bots exempt;
+# reports on merge_group). Humans must sign off (git commit -s).
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  merge_group:
+
+permissions: {}
+
+jobs:
+  dco:
+    uses: netresearch/.github/.github/workflows/dco.yml@main # NOSONAR — own-org reusable deliberately tracks main
+    permissions:
+      contents: read
+      pull-requests: read