[kwisatzh]

Summary

• Remove the retired pull_request DCO and signature workflows after their trusted API-only replacements have passed on a real PR and become required.
• Remove the duplicate legacy DCO test file; all 64 behavioral cases remain in the trusted suite.
• Use the collector's reviewed final workflows and tests byte for byte from commit 303b86637cc33e9624194d758b4be10ba8a16b59.
• Update contributor-facing check names where present. No runtime or release change.

The trusted checks remain read-only and API-only. They never check out or execute PR code. trusted-api-tests remains on unprivileged pull_request.

Validation

• All 232 final trusted tests pass locally, with no skips.
• Scoped actionlint, exact-source hash checks and diff checks pass.
• Trusted checker logic and every behavioral assertion match the reviewed collector source.
• Before merging, read back the rule set and require all final-head checks under the new trusted names. Preserve every other required check and rule; use no bypass.