chore: add SPDX headers, DCO enforcement, and build-debug target

[CybotTM]

Summary

• Add SPDX copyright and MIT license headers to all 225 Go source files
• Add DCO enforcement via lefthook commit-msg hook
• Add build-debug Makefile target and BUILD_FLAGS variable for debug symbol preservation
• Supports OpenSSF Best Practices Silver badge criteria (license_per_file, copyright_per_file, dco, build_preserve_debug)

Test plan

• Verify SPDX headers present in Go files
• Verify make build-debug produces binary with debug symbols
• Verify lefthook DCO hook rejects unsigned commits

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[github-actions]

⚠️ Mutation Testing Results

Mutation Score: 0.00% (threshold: 60%)

⚠️ Score is below threshold. Consider improving test coverage or test quality.

What is mutation testing?

Mutation testing measures test quality by introducing small changes (mutations) to the code and checking if tests detect them. A higher score means better test effectiveness.

• Killed mutants: Tests caught the mutation (good!)
• Survived mutants: Tests missed the mutation (needs improvement)

[github-actions]

Automated approval for solo maintainer project

All CI checks passed. See SECURITY.md for compensating controls.

[Copilot]

Pull request overview

This PR adds SPDX copyright headers to all Go source files, implements DCO enforcement via a lefthook commit-msg hook, and introduces build targets for debug symbol preservation. These changes support OpenSSF Best Practices Silver badge criteria for license_per_file, copyright_per_file, dco, and build_preserve_debug.

Changes:

• Added SPDX-License-Identifier and copyright headers to 225 Go files
• Implemented DCO sign-off enforcement with lefthook commit-msg hook
• Added build-debug Makefile target and BUILD_FLAGS variable for controlling debug symbol stripping

Reviewed changes

Copilot reviewed 228 out of 228 changed files in this pull request and generated 1 comment.

File	Description
All Go source files	Added SPDX license identifier and copyright headers
lefthook.yml	Added DCO sign-off validation in commit-msg hook
Makefile	Added BUILD_FLAGS variable and build-debug target for debug symbol preservation
CONTRIBUTING.md	Added DCO documentation section with sign-off instructions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codspeed-hq]

Merging this PR will degrade performance by 14.6%

⚡ 1 improved benchmark
❌ 1 regressed benchmark
✅ 24 untouched benchmarks

⚠️ Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	BenchmarkExecutionMemoryWithoutPool	9.3 ms	10.8 ms	-14.6%
⚡	remove	43.8 µs	39.2 µs	+11.74%

---

_{Comparing chore/spdx-dco-headers (a512d10) with main (f141679)}

[github-actions]

🚀 Released in v0.21.0

Thank you for your contribution! 🙏

This is now available in the latest release. Please test and verify everything works as expected in your environment.

If you encounter any issues, please open a new issue.