Add the Contributor Assignment Agreement (CAA) gate: PRs require signing before merge.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: rowan-claude

.github/workflows/cla.yml

@@ -0,0 +1,51 @@
+# .github/workflows/cla.yml  -- goes in EACH library repo.
+# Blocks a PR from merging until every human commit-author has signed the
+# Contributor Assignment Agreement (CAA). Signatures are recorded per GitHub
+# user in one central file, so a person signs once and it counts everywhere.
+#
+# Contributors sign by posting this exact comment on their PR:
+#   I have read the CAA and I hereby sign it, assigning copyright in my
+#   contributions to Más Bandwidth LLC.
+#
+# REQUIRES a repo or org secret named CLA_SIGNATURES_TOKEN (a fine-grained or
+# classic PAT with contents + pull-requests write on the library repos and on
+# mas-bandwidth/.github). The built-in GITHUB_TOKEN is read-only for pull
+# requests from forks, which is exactly the case we need to gate, so the PAT is
+# required. Do not commit the token, add it in repo/org Settings -> Secrets.
+
+name: Contributor Assignment Agreement
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, synchronize]
+
+permissions:
+  actions: write
+  contents: read
+  pull-requests: write
+  statuses: write
+
+jobs:
+  caa:
+    runs-on: ubuntu-latest
+    steps:
+      - name: CAA check
+        if: (github.event.comment.body == 'I have read the CAA and I hereby sign it, assigning copyright in my contributions to Más Bandwidth LLC.') || github.event_name == 'pull_request_target'
+        uses: contributor-assistant/github-action@v2.6.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_SIGNATURES_TOKEN }}
+        with:
+          # one central signature store for the whole org -> per-user tracking
+          remote-organization-name: mas-bandwidth
+          remote-repository-name: .github
+          branch: cla-signatures
+          path-to-signatures: signatures/caa.json
+          path-to-document: https://github.com/mas-bandwidth/.github/blob/main/CAA.md
+          # our own accounts and bots never need to sign
+          allowlist: gafferongames,rowan-claude,*[bot]
+          custom-notsigned-prcomment: 'Thanks for the contribution. Before it can be merged, please read the [Contributor Assignment Agreement](https://github.com/mas-bandwidth/.github/blob/main/CAA.md) and sign it by posting the exact sentence below as a comment on this PR.'
+          custom-pr-sign-comment: 'I have read the CAA and I hereby sign it, assigning copyright in my contributions to Más Bandwidth LLC.'
+          custom-allsigned-prcomment: 'All contributors have signed the CAA. Thank you.'
+          lock-pullrequest-aftermerge: false