docs: adopt no-CLA + DCO policy and fix copyright terms

[Vonng]

Syncs the contribution and copyright policy adopted in pgsty/mc (PRs #2, #3) into the server, and fixes a copyright defect found while comparing the two.

Copyright terms (defect)

startupBanner overwrote the ldflags-injected CopyrightYear with time.Now().Year() and printed it as the end of MinIO, Inc.'s term:

CopyrightYear = strconv.Itoa(time.Now().Year())
fmt.Fprintln(banner, ... " 2015-%s MinIO, Inc.", CopyrightYear)
fmt.Fprintln(banner, ... " Copyright 2026 PGSTY contributors")

Two problems: every January would extend MinIO's copyright claim past 2025, where upstream development actually ended; and release builds silently discarded the year the release pipeline injected. The fork's own line was hardcoded to a single year with no start.

Both banners now read:

Copyright: 2015-2025 MinIO, Inc.
Modifications: Copyright 2025-2026 PGSTY

MinIO's term is a fixed constant; PGSTY runs from the fork's start year through the release-stamped year, falling back to the current year in source builds (previously 2015-0000 on --version). NOTICE now names PGSTY as the holder of the fork's modifications, matching the banners and the PGSTY packaging vendor field — it previously said "The Silo Authors", a third spelling.

Contribution policy

No CLA. The core is Copyright MinIO, Inc., so the combined work can never be relicensed and a CLA would create signing friction while buying nothing. Contributions are accepted inbound=outbound under AGPL-3.0-or-later, contributors keep their copyright.

What a fork carrying a downstream delta does need is provenance — cherry-picks from the lineage remote are routine here — so DCO 1.1 sign-off is now mandatory, enforced by .github/workflows/dco.yml (dependency-free check; rejects unsigned non-bot commits, requires the sign-off email to match the author). CONTRIBUTING.md gains a Licensing of Contributions section covering sign-off, git rebase --signoff repair, cherry-pick provenance (-x plus relayer sign-off, never import from a proprietary distribution), dual copyright headers for fork-authored files, trailer preservation across squash merges, and that assistive-tooling trailers (e.g. Co-Authored-By: naming an AI) carry no authorship or copyright claim. README (EN/ZH) and the PR template point at the policy.

Guard rules

verify-rebrand.sh now pins the copyright split (including rejecting the clock-derived pattern) and the presence of the policy files, so neither can regress.

Verification

go build, go vet ./cmd/..., gofmt, and verify-rebrand.sh all pass. Built binary prints the banner shown above.

Not included

• code_of_conduct.md reporting channel: silo routes reports "through this repository" while mc uses a maintainer email. Not a defect (the upstream dev@min.io address that mc had is already gone here), and switching channels is a governance decision — flagging rather than changing.
• Stray legacy .github/ISSUE_TEMPLATE.md duplicating ISSUE_TEMPLATE/bug_report.md (GitHub ignores the root file); mc removed its copy. Left out to keep this PR to licensing and copyright.
• Branch protection on main and required checks — owner action.

🤖 Generated with Claude Code