Publication preparation: MIT license, security policy, and public metadata

[maximalfocus]

Closes #7.

Everything that must be true before this repository can be read by strangers. No service, property
contract, walkthrough case, or fixture changes — the gate still proves the same 360 behaviors.

What landed

File	Why
LICENSE	canonical MIT, Copyright (c) 2026 maximalfocus
pyproject.toml	PEP 639 license = "MIT" + license-files, and hatchling>=1.27
Dockerfile	copies LICENSE beside README.md, which the project build now needs
SECURITY.md	the FR-019 safety and reporting contract
README.md	licensing and reporting sections, plus a don't-reuse-this warning

The license metadata is real, not decorative

The declaration is verified through the built artifact rather than by reading the file back:

Metadata-Version: 2.5
Name: fieldblind
Version: 0.1.0
License-Expression: MIT
License-File: LICENSE
--- license files packaged ---
['fieldblind-0.1.0.dist-info/licenses/LICENSE']

License-Expression is the SPDX form, so this is machine-readable licensing rather than a loose
classifier. That is also why hatchling moved to >=1.27 — 1.25 silently ignores PEP 639 metadata,
which would have produced a wheel claiming no license at all.

Adding license-files had one non-obvious consequence worth recording: the build reads LICENSE,
but the Dockerfile copied only pyproject.toml, uv.lock, README.md, and src before
uv sync --locked. Without the extra copy the image build fails outright. A cached-image run hides
this — the first gate run here passed against a stale fieldblind:local and proved nothing about
the change, so the result below is from --no-cache.

SECURITY.md draws the line the demo needs

The hazard in publishing this project is a reader mistaking the deliberate flaw for an accident, or
a researcher filing "the vulnerable service is vulnerable." So the policy states plainly that the
vulnerable service's excessive data exposure and mass assignment are the product, and scopes
reports to genuinely unintended weaknesses: reaching the vulnerable service without both opt-in
actions, container escape or egress, a real credential or personal datum committed here, the
secure service breaking its own property contract, or protected values reaching logs.

Reporting goes through this repository's Security tab rather than an email address, so no personal
contact data is published.

Verification

Rebuilt with --no-cache, then:

--- ruff format --check
34 files already formatted
--- ruff check
All checks passed!
--- mypy --strict
Success: no issues found in 33 source files
--- pytest
360 passed in 4.62s
--- verification complete

docker compose run --rm verify exits 0. The documented walkthrough still passes 8/8 and exits
0. Containers and networks were torn down after.

Not in this change

Repository description, topics, and visibility are provider metadata rather than tracked files, so
they are set alongside the visibility change itself — after this lands and the exposure review is
confirmed clean. Nothing here is deployed, hosted, or published as a package or image.