[scanner] ci: meeting-recordings-refresh PRs fail DCO — add signoff: true to create-pull-request #250

CI Issue

The daily meeting-recordings-refresh.yml workflow (added in #246) opens its PR via peter-evans/create-pull-request without signoff: true, so every refresh PR arrives with an unsigned commit and fails both the probot DCO check and the prow dco status (dco-signoff: no). docs#249 was the first instance; it needed a manual force-pushed rewrite to carry a Signed-off-by: trailer.

Evidence

• docs#249 head 424c8d0: DCO → action_required, dco → failure, while Lint and build and Audit production dependencies were green.
• An appended empty signed commit did not clear it — both checks evaluate every commit, so the rewrite was required.
• .github/workflows/meeting-recordings-refresh.yml lines 33-43: create-pull-request@5f6978f… with: has branch, delete-branch, add-paths, commit-message, title, body — no signoff.

Fix (one line)

      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          signoff: true

signoff: true adds Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> matching the commit author, which both DCO checks accept.

This is a .github/workflows/** edit, which the hive App's contributor-tier token cannot push — needs a maintainer or an ISSUES_PRS_MERGE agent.

Part of #245 (Step 2 follow-up: the refresh PR must be mergeable without manual intervention).

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88