[kwisatzh]

Summary

• Add the collector's reviewed trusted API-only DCO and signature checks alongside the existing checks.
• Copy the three workflows and test suite byte for byte from collector commit 705d386a0917bc323b0f2ea1110f4e6e6bffa124, including the immutable-comparison pagination fix from collector #108.
• Keep existing workflows, tests, permissions and required-check settings unchanged in this PR.

The pull_request_target workflows have read-only permissions and never check out or execute PR code. Regression tests that execute PR code run separately on pull_request with persisted credentials disabled.

Validation

• All 298 legacy-plus-trusted checks pass locally; no skips.
• Scoped actionlint and diff checks pass.
• Exact source hashes match the reviewed collector files; the three legacy files remain byte-identical.
• Final-head hosted checks must pass before the protected merge.

Staged Rollout

This addition merges through the existing DCO and signature checks. The trusted checks must next pass on a real PR before their names replace the required legacy names. Cleanup merges only after the new required checks are active. No protection bypass, release or runtime change.