quarantine: scrub tailnet ref, add license, ship lab/ repro kit, refresh README for cohort

- untrack CLAUDE.md (tailnet leak) + stale HANDOFF.md; keep local via .gitignore
- add source-available LICENSE (attribution on fork, royalty on commercial use)
- add lab/ reproduction kit (fake-cred LIVE-VM/mock rotation POCs) + lab/README
- rewrite README to current status (22 drivers, 8 LIVE-VM/14 MOCK-ONLY/0 LIVE-REAL,
  247 tests) and carry the credential-handling safety rules

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lab/lab-provision-gitea.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+# Provision the incredigo Gitea-PAT-rotation POC inside the sandbox VM.
+# FAKE/self-owned local Gitea only, isolated gopass store. Idempotent-ish.
+set -euo pipefail
+
+export GNUPGHOME="$HOME/.lab-gnupg"
+export GOPASS_HOMEDIR="$HOME/.lab-gopass"
+GITEA_DIR="$HOME/gitea-lab"
+GITEA_USER="labadmin"
+GITEA_PW="labpw123"
+ENTRY="imported/gitea/labtoken"
+OLDTOK_FILE="$HOME/.lab-gitea-oldtoken"
+
+echo "== 1. stop any prior gitea, reset work dir =="
+pkill -f 'gitea web' 2>/dev/null || true
+sleep 1
+rm -rf "$GITEA_DIR"
+mkdir -p "$GITEA_DIR/data" "$GITEA_DIR/repos" "$GITEA_DIR/custom/conf"
+
+cat > "$GITEA_DIR/custom/conf/app.ini" <<INI
+APP_NAME = incredigo-lab
+RUN_USER = $(whoami)
+RUN_MODE = prod
+WORK_PATH = $GITEA_DIR
+
+[server]
+PROTOCOL = http
+HTTP_ADDR = 127.0.0.1
+HTTP_PORT = 3000
+ROOT_URL = http://127.0.0.1:3000/
+DISABLE_SSH = true
+OFFLINE_MODE = true
+
+[database]
+DB_TYPE = sqlite3
+PATH = $GITEA_DIR/data/gitea.db
+
+[repository]
+ROOT = $GITEA_DIR/repos
+
+[security]
+INSTALL_LOCK = true
+SECRET_KEY = labsecretkeylabsecretkey
+PASSWORD_HASH_ALGO = argon2
+
+[service]
+DISABLE_REGISTRATION = true
+
+[log]
+MODE = console
+LEVEL = warn
+INI
+
+export GITEA_WORK_DIR="$GITEA_DIR"
+CONF="$GITEA_DIR/custom/conf/app.ini"
+
+echo "== 2. migrate db + create admin user ($GITEA_USER) =="
+gitea -c "$CONF" migrate >/dev/null 2>&1
+gitea -c "$CONF" admin user create \
+  --admin --username "$GITEA_USER" --password "$GITEA_PW" \
+  --email lab@incredigo.invalid --must-change-password=false >/dev/null 2>&1
+
+echo "== 3. start gitea (http://127.0.0.1:3000) =="
+nohup gitea -c "$CONF" web >"$GITEA_DIR/gitea.log" 2>&1 &
+for i in $(seq 1 30); do
+  curl -fsS http://127.0.0.1:3000/api/v1/version >/dev/null 2>&1 && break
+  sleep 1
+done
+echo "   version: $(curl -fsS http://127.0.0.1:3000/api/v1/version)"
+
+echo "== 4. create initial (seed) token via basic auth =="
+SEED_NAME="seed-$(date +%s)"
+SEED_JSON=$(curl -fsS -u "$GITEA_USER:$GITEA_PW" \
+  -H 'content-type: application/json' \
+  -d "{\"name\":\"$SEED_NAME\",\"scopes\":[\"write:user\",\"read:user\"]}" \
+  http://127.0.0.1:3000/api/v1/users/$GITEA_USER/tokens)
+SEED_TOK=$(printf '%s' "$SEED_JSON" | sed -n 's/.*"sha1":"\([0-9a-f]*\)".*/\1/p')
+test -n "$SEED_TOK" || { echo "FAILED to mint seed token: $SEED_JSON"; exit 1; }
+printf '%s' "$SEED_TOK" > "$OLDTOK_FILE"
+echo "   seed token name=$SEED_NAME (value saved to $OLDTOK_FILE for the cutover check)"
+
+echo "== 5. isolated GNUPGHOME + no-protection GPG key =="
+rm -rf "$GNUPGHOME" "$GOPASS_HOMEDIR"
+mkdir -p "$GNUPGHOME"; chmod 700 "$GNUPGHOME"
+cat > /tmp/keyparams <<EOF
+%no-protection
+Key-Type: eddsa
+Key-Curve: ed25519
+Subkey-Type: ecdh
+Subkey-Curve: cv25519
+Name-Real: incredigo lab
+Name-Email: lab@incredigo.invalid
+Expire-Date: 0
+%commit
+EOF
+gpg --batch --gen-key /tmp/keyparams >/dev/null 2>&1
+rm -f /tmp/keyparams
+KEYID=$(gpg --list-keys --with-colons lab@incredigo.invalid | awk -F: '/^pub/{print $5; exit}')
+echo "   key: $KEYID"
+
+echo "== 6. isolated gopass store =="
+gopass init --storage fs "$KEYID" >/dev/null 2>&1 || gopass init "$KEYID" >/dev/null 2>&1
+gopass ls >/dev/null 2>&1 || true
+
+echo "== 7. seed driver-ready blob into gopass (token + mgmt pw in query) =="
+# Blob: http://user:token@host/?name=<tokenname>&pw=<mgmt-password>
+BLOB="http://$GITEA_USER:$SEED_TOK@127.0.0.1:3000/?name=$SEED_NAME&pw=$GITEA_PW"
+printf '%s' "$BLOB" | gopass insert --multiline=false -f "$ENTRY" >/dev/null
+echo "   stored $ENTRY:"
+gopass ls --flat | sed 's/^/     /'
+
+echo "== 8. prove the seed token authenticates now =="
+curl -fsS -H "Authorization: token $SEED_TOK" http://127.0.0.1:3000/api/v1/user \
+  | sed -n 's/.*"login":"\([^"]*\)".*/   GET \/user -> login=\1/p'
+
+echo "DONE. Run: GNUPGHOME=$GNUPGHOME GOPASS_HOMEDIR=$GOPASS_HOMEDIR \\"
+echo "  INCREDIGO_PASSPHRASE=labseal123 INCREDIGO_ALLOW_EXECUTE=1 incredigo rotate --execute"