fix(ci): store CLA signatures on an unprotected branch (the CLA gate was unpassable)

[hmanoor]

The bug

The CLA gate could not be passed by anyone, including the repo owner. Signing did nothing.

Root cause, from the workflow log:

Error occurred when creating the signed contributors file: Could not create file:
Changes must be made through a pull request. 4 of 4 required status checks are expected..
Make sure the branch where signatures are stored is NOT protected.
##[error]Committers of pull request 13 have to sign the CLA

contributor-assistant/github-action commits the signatures file directly to the branch given in its branch: input. That was set to main, which is branch-protected — so the write was rejected, the signature was never persisted, and the action then reported the contributor as unsigned. The bot's PR comment even flipped to "All contributors have signed the CLA ✅" while the check stayed red, because the comment and the persisted state are separate things.

Net effect: an outside contributor could sign, be told they'd signed, and still be blocked. For a project actively recruiting contributors that's about as bad as a CI bug gets.

The fix

Point branch: at a dedicated unprotected branch, cla-signatures (created, verified unprotected). Added a comment beside the setting explaining why it must never be main, since the failure mode is silent and the error only shows in the action log.

Verification

After merge, comment recheck on any open PR — the action should persist the signature to cla-signatures and the check should go green. I'll confirm on #13.

🤖 Generated with Claude Code

[github-actions]

Thank you for your contribution! Before we can merge it, please read our Contributor License Agreement and sign it by posting the following comment:

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}