chore: REUSE workflow, DCO sign-off, pid parameter tests and notes

[yallioux]

What and why

• Fix: a regular expression in tests/test_spdx_headers.py held the licence tag in one piece, so reuse lint read it as a second, invalid licence tag; the pattern is now split.
• CI: a REUSE workflow runs reuse lint on each push and pull request.
• DCO: DCO (v1.1), a section in CONTRIBUTING.md, docs/contributing/dco_howto.md, .github/dco.yml, a sign-off line in the PR template; licence text and annotation in LICENSES/ and REUSE.toml.
• PID: tests and a note on d_pen and on the derivative being computed along the frame given to predict(). The frame dependence itself is not fixed here: a fix changes results.
• No forecast changes.

Checklist

CHANGELOG entry	Test (name; fails before the change?)	math/ page	architecture/ page	User docs (README, THEORY, docstrings)	Callers checked	Regression
DCO sign-off and REUSE workflow	test_a_file_carries_one_licence_tag_not_a_pattern_that_looks_like_one (fails before the change); the workflow runs reuse lint	Not needed: no theory	Not needed: no code	CONTRIBUTING.md, docs/contributing/dco_howto.md	Not needed: no code change	Unchanged
pid() note and tests	test_pid_beats_a_linear_term_when_the_derivative_carries_the_signal, test_d_pen_is_hidden_by_the_default_penalty, test_d_pen_acts_when_the_penalty_is_explicit (they pin existing behaviour, so they pass before the change)	Not needed	architecture/core/06_the_spectrum_api.md	Same page	Not needed: no code change	Unchanged

• Tests pass locally (pytest). The REUSE test was written first and fails without the fix; the three pid tests describe existing behaviour and pass without it.
• Docs: the architecture/ page is updated; no math/ change.
• One CHANGELOG.md line per user-visible change, under [Unreleased].
• No frozen public API change.
• No print() in new code.
• Data used by tests and examples is public.
• Every added file keeps its header or is annotated in REUSE.toml.
• Every commit is signed off (git commit -s).

Pre-push verdict

pytest tests passes and reuse lint is compliant (339 of 339 files).