Spec cleanup: remove orphan input, declare output, sync README

Four inconsistencies found while reviewing the spec surface after the
recent opener-mismatch work:

1. The [!CAUTION] block in the bot comment named the upstream project
   ('contributor-assistant/github-action') as the step to configure.
   This repo is a fork (iainmcgin/cla-github-action), and any other
   downstream will have a different step name. Replace with generic
   'CLA-assistant step' so the guidance stays accurate regardless of
   who consumes the action.

2. action.yml still declared the 'signed-empty-commit-message' input.
   No handler in src/ reads it, and the empty-commit feature it paired
   with was removed in the earlier Phase 7 cleanup. Drop it.

3. The action emits core.setOutput('opener_not_in_commits', true) at
   runtime but did not declare it in action.yml's (previously absent)
   outputs section. Add the outputs: block so maintainers can see the
   contract and downstream steps can reference it in workflow
   expressions like steps.cla.outputs.opener_not_in_commits.

4. The README Inputs Description table was missing both the new
   require-opener-as-author row and the pre-existing use-dco-flag row
   (the latter is in action.yml since forever but never made it to the
   README). Added both, plus a new 'Outputs' section for the output
   declared in (3).

Author: iainmcgin

README.md

@@ -143,6 +143,14 @@ This PAT should have repo scope and is only required if you have configured to s
 | `custom-allsigned-prcomment`   | _optional_ | pull request comment when everyone has signed | All Contributors have signed the CLA. |
 | `lock-pullrequest-aftermerge`   | _optional_ | Boolean input for locking the pull request after merging. Default is set to `true`.  It is highly recommended to lock the Pull Request after merging so that the Contributors won't be able to revoke their signature comments after merge | false |
 | `suggest-recheck`   | _optional_ | Boolean input for indicating if the action's comment should suggest that users comment `recheck`. Default is set to `true`. | false |
+| `use-dco-flag`   | _optional_ | Boolean input. Set to `true` to run the action in DCO (Developer Certificate of Origin) mode instead of CLA mode. The bot's prompts and persistence logic use DCO wording. Default is `false`. | true |
+| `require-opener-as-author`   | _optional_ | Boolean input. When `true` (the default), fail the check if the Pull Request opener is not recorded as an author or co-author of any commit. Guards against an attacker opening a PR whose commits are attributed to an identity they do not control. Set to `false` for workflows that legitimately involve submitting commits authored by others (cherry-picks, release-engineering patch submission, mailing-list-style contribution). | false |
+
+### Outputs
+
+| Name                  | Description |
+| --------------------- | ----------- |
+| `opener_not_in_commits` | Set to `'true'` when the Pull Request opener is not recorded as an author or co-author of any commit in the PR. Emitted regardless of whether `require-opener-as-author` caused the check to fail. |
 
 ## Contributors
 

action.yml

@@ -22,8 +22,6 @@ inputs:
     description: "Fully qualified web link to the document - example: https://github.com/cla-assistant/github-action/blob/master/SAPCLA.md"
   signed-commit-message:
     description: "Commit message when a new contributor signs the CLA in a PR"
-  signed-empty-commit-message:
-    description: "Commit message when a new contributor signs the CLA (empty)"
   create-file-commit-message:
     description: "Commit message when a new file is created"
   custom-notsigned-prcomment:
@@ -51,6 +49,14 @@ inputs:
       others (cherry-picks, release-engineering patch submission, mailing-list
       style contribution workflows).
     default: "true"
+outputs:
+  opener_not_in_commits:
+    description: >
+      Set to 'true' when the Pull Request opener is not recorded as an author
+      or co-author of any commit in the PR. Emitted regardless of whether
+      'require-opener-as-author' caused the check to fail, so repositories
+      can gate additional workflows (e.g. branch protection rules) on this
+      output independently of the CLA-check pass/fail.
 runs:
   using: "node24"
   main: 'dist/index.js'

dist/index.js

@@ -31051,7 +31051,7 @@ function renderOpenerMismatchBlock(mismatch) {
 > - Opener: @${mismatch.opener}
 > - Commit authors: ${authorList}
 >
-> This check is blocked to guard against commits being submitted under a trusted identity the submitter does not control. If this PR is a legitimate cherry-pick, release-engineering submission, or mailing-list-style patch delivery, the repository maintainer can opt out of this check by setting \`require-opener-as-author: 'false'\` on the \`contributor-assistant/github-action\` step in the repository's workflow.
+> This check is blocked to guard against commits being submitted under a trusted identity the submitter does not control. If this PR is a legitimate cherry-pick, release-engineering submission, or mailing-list-style patch delivery, the repository maintainer can opt out of this check by setting \`require-opener-as-author: 'false'\` on the CLA-assistant step in the repository's workflow.
 
 `;
     }

src/pullrequest/pullRequestCommentContent.ts

@@ -115,7 +115,7 @@ function renderOpenerMismatchBlock(mismatch: {
 > - Opener: @${mismatch.opener}
 > - Commit authors: ${authorList}
 >
-> This check is blocked to guard against commits being submitted under a trusted identity the submitter does not control. If this PR is a legitimate cherry-pick, release-engineering submission, or mailing-list-style patch delivery, the repository maintainer can opt out of this check by setting \`require-opener-as-author: 'false'\` on the \`contributor-assistant/github-action\` step in the repository's workflow.
+> This check is blocked to guard against commits being submitted under a trusted identity the submitter does not control. If this PR is a legitimate cherry-pick, release-engineering submission, or mailing-list-style patch delivery, the repository maintainer can opt out of this check by setting \`require-opener-as-author: 'false'\` on the CLA-assistant step in the repository's workflow.
 
 `
   }