quarantine: scrub tailnet ref, add license, ship lab/ repro kit, refresh README for cohort

- untrack CLAUDE.md (tailnet leak) + stale HANDOFF.md; keep local via .gitignore
- add source-available LICENSE (attribution on fork, royalty on commercial use)
- add lab/ reproduction kit (fake-cred LIVE-VM/mock rotation POCs) + lab/README
- rewrite README to current status (22 drivers, 8 LIVE-VM/14 MOCK-ONLY/0 LIVE-REAL,
  247 tests) and carry the credential-handling safety rules

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lab/lab-run.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Exercise incredigo end-to-end against the fake lab store. Read-mostly; the only
+# writes are into the throwaway gopass store and sealed bundles in the lab dir.
+set -uo pipefail
+export PATH=/usr/local/bin:$PATH
+export GOPASS_HOMEDIR="$HOME/.lab-gopass"
+export GNUPGHOME="$HOME/.lab-gnupg"
+export GOPASS_NO_NOTIFY=true
+export INCREDIGO_PASSPHRASE='lab-seal-pass-correct-horse'
+cd "$HOME/lab"
+
+run() { echo; echo "############ $* ############"; "$@"; echo "---- exit=$? ----"; }
+
+run incredigo scan
+run incredigo status
+run incredigo migrate --dedupe
+echo; echo "## gopass store after migrate:"; gopass ls --flat
+run incredigo export --prefix imported/ --out "$HOME/lab/backup.age"
+run incredigo import --in "$HOME/lab/backup.age" --prefix restored/
+echo; echo "## store after import:"; gopass ls --flat
+run incredigo rotate --prefix imported/ --dry-run --blast --blast-root "$HOME/lab"
+run incredigo worklist
+echo; echo "LAB_RUN_DONE"