quarantine: scrub tailnet ref, add license, ship lab/ repro kit, refresh README for cohort

- untrack CLAUDE.md (tailnet leak) + stale HANDOFF.md; keep local via .gitignore
- add source-available LICENSE (attribution on fork, royalty on commercial use)
- add lab/ reproduction kit (fake-cred LIVE-VM/mock rotation POCs) + lab/README
- rewrite README to current status (22 drivers, 8 LIVE-VM/14 MOCK-ONLY/0 LIVE-REAL,
  247 tests) and carry the credential-handling safety rules

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -14,6 +14,16 @@
 docs/ROTATION.md
 docs/ROTATION-REAL-CRED-RUNBOOK.md
 
+# maintainer-local: AI session directive (tailnet detail) + stale dev handoff
+CLAUDE.md
+HANDOFF.md
+
+# lab kit: ship the scripts, never the binaries or real-host / runbook material
+lab/incredigo
+lab/gitea
+lab/*.age
+lab/rung1-*
+
 # editor / OS
 *.swp
 .DS_Store