🐛 adoption: DCO in-place repair never executes; merge commits and fork heads abort the re-sign #14927

Gap left after #14688 (which closed #14666)

#14688 re-signs inherited unsigned commits on the supersede re-home path only. Seen live on #14710 (fork head, stage/074-adopted-by-hive, no-dco, probot dco red): the hive logged reason=dco-missing on every pass and never re-signed anything.

1. adoptionDCORepairMode returns AdoptModeInPlace when every unsigned commit is the hive's own and the branch is pushable — but nothing executes that repair, so the PR holds at 074 indefinitely.
2. resignAdoptionCommits bails on any head containing a merge commit; the update-branch recovery (Adopted PRs red only from a since-fixed shared-CI flake are escalated instead of updated/re-run #14500) adds Merge branch 'v5' into …, so even the supersede path pushes hive/adopt-<n> with the unsigned commit intact.
3. The installation token cannot rewrite a fork branch, so an in-place repair of a fork head is impossible — fork heads must always convert to supersede.

Expected

• In-place repair for base-repo heads (git-data replay with Signed-off-by appended, lease-checked UpdateRef(force), once per head).
• Fork heads always mode=supersede / reason=dco-rehome.
• Merge commits replayed with mapped parents instead of aborting.

Fix in #14787 (opened against #14666 before that issue was closed by #14688; retargeted here).