ci: GitHub's "Update branch" button turns the DCO check red

[L4XB]

Problem

Protect main and Protect develop require branches to be up to date, so a
pull request that falls behind has to be updated. GitHub's own answer is the
"Update branch" button, which writes a merge commit onto the contribution
branch, authored by whoever clicked it and carrying no Signed-off-by trailer.

check_dco.py validates every commit in base..head:

commits = _git("rev-list", "--reverse", f"{base_id}..{head_id}").splitlines()

A merge commit is one of them, so the button turns the DCO check red on a pull
request that was green a moment earlier. The contributor sees "One or more
contribution commits lack a valid DCO sign-off" and has no way to connect that to
the button they just pressed.

This is not theoretical: every pull request here goes behind as soon as another
one merges, which happened repeatedly while landing #70, #72, #75, #76, #78
and #80.

The trade-off

Skipping merge commits is what most DCO implementations do, on the reasoning
that a merge introduces no new authorship. That is usually true and not always:
a conflict resolution inside a merge commit is new work by the person who
resolved it, and skipping merges stops certifying it.

So this is a decision, not a defect to patch silently.

Options

1. Skip merges (rev-list --no-merges) and state in CONTRIBUTING.md that
   conflict resolutions belong in their own signed-off commit.
2. Keep validating merges and tell contributors not to use the button —
   rebase instead — including in the reminder feat(contributing): tell an author how to accept the CLA instead of failing silently #64 posts.
3. Remove the reason to update: a merge queue batches pull requests against
   the real base, so branches stop going behind at all (see ci: stop running three macOS jobs for pull requests without Swift changes #71).

Acceptance criteria

• Pressing "Update branch" either keeps the DCO check green or is documented
  as the wrong move, in the place a contributor reads before pressing it.
• Whichever option is chosen, a test covers a merge commit in the range.
• The reminder in feat(contributing): tell an author how to accept the CLA instead of failing silently #64 mentions it if the answer is "rebase instead".