Add CLA Assistant Lite workflow

[verivusOSS-releases]

Adds .github/workflows/cla.yml so this repo participates in the org-wide
Contributor License Agreement (CLA) check.

How it works:

• On each pull request, the CLA Assistant Lite action verifies that every
  commit author has signed the CLA at
  https://github.com/verivus-oss/cla/blob/main/CLA.md
• An unsigned contributor signs by posting this comment on their PR:
  "I have read the CLA Document and I hereby sign the CLA"
• Signatures are stored in the private verivus-oss/cla-signatures repo and are
  valid across every verivus-oss repo (sign once).

Security notes:

• Both actions are pinned to commit SHAs (the CLA action upstream is archived).
• No PAT is used. A dedicated org GitHub App mints a short-lived, repo-scoped
  token at runtime to write signatures.

PREREQUISITE before merging: the "Verivus CLA Assistant" GitHub App plus the
org-level CLA_APP_ID variable and CLA_APP_KEY secret must be configured.
Until then the token step will fail, so please do not merge this yet.