docs: add repository agent workflow

[lykakis]

Summary

• Add repository-wide agent instructions for DCO sign-off.
• Clarify that cryptographic signing does not replace the Signed-off-by: trailer.
• Require branches to be rebased onto the latest origin/main before opening a pull request.
• Require --force-with-lease when a published branch must be updated after rebasing.

Motivation

This captures the workflow lessons from the Quick Start documentation change and prevents future DCO failures or pull requests being opened from stale branches.

Verification

• Commit has a valid SSH signature and DCO trailer.
• git rev-list --count HEAD..origin/main returns 0.
• git diff --check passes.
• Documentation-only change; no runtime tests required.