Standardise license setup: MPL-2.0 + PMPL-1.0-or-later (REUSE)

- LICENSE: pure MPL-2.0 text for machine detection (GitHub, registries)
- LICENSES/MPL-2.0.txt: standard MPL-2.0 text
- LICENSES/PMPL-1.0-or-later.txt: Palimpsest License text
- NOTICE: explains the dual-license relationship
- Source SPDX headers remain PMPL-1.0-or-later

This ensures OSI compliance checks pass while preserving PMPL as
the governing license for source code.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.bot_directives/echidnabot.scm

@@ -1,7 +1,18 @@
 ;; SPDX-License-Identifier: PMPL-1.0-or-later
 (bot-directive
   (bot "echidnabot")
-  (scope "formal verification and fuzzing")
-  (allow ("analysis" "fuzzing" "proof checks"))
-  (deny ("write to core modules" "write to bindings"))
+  (scope "formal verification, fuzzing, and property-based testing")
+  (languages ("Rust" "Elixir" "ReScript"))
+  (targets
+    ("services/*/src/" "Rust service binaries")
+    ("opsm_ex/" "Elixir application and NIFs")
+    ("cli/" "CLI tooling"))
+  (allow ("analysis" "fuzzing" "proof checks" "property testing" "unsafe auditing"))
+  (deny ("write to core modules" "write to bindings" "modify Cargo.lock"))
+  (scanning-rules
+    (rust
+      (ban ("unsafe" "transmute") (unless "// SAFETY: comment present"))
+      (flag ("unwrap" "expect") (severity "medium")))
+    (elixir
+      (flag ("Code.eval_string" "apply/3 with dynamic module") (severity "high"))))
   (notes "May open findings; code changes require explicit approval"))

.github/workflows/hypatia-scan.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0  # Full history for better pattern analysis