Every Progmasoft-authored file moves from MPL-2.0 WITH
AdditionRef-Progmasoft-Exception-2.0 to LGPL-3.0-or-later, from 0.5.0
on. Catch2-originated files keep BSL-1.0, and the vendored yyjson and
pugixml keep MIT.

- LICENSES/ holds the LGPL-3.0 text and the GPL-3.0 text it builds on,
  both as published by the FSF; the MPL-2.0 and Progmasoft Exception
  texts go, since no file uses them any more.
- Five files that came from Catch2 and were rewritten by Progmasoft
  (.clang-format, the issue and pull request templates, SECURITY.md)
  keep Catch2's notice next to Progmasoft's and say
  LGPL-3.0-or-later AND BSL-1.0.
- //tools:check expects the new header of Progmasoft files; the
  amalgamation notes say LGPL-3.0-or-later and the amalgamated files
  are regenerated; meson's project license is BSL-1.0 and
  LGPL-3.0-or-later.
- README gains a License section; LICENSES/README.md, contributing.md
  and progmasoft-catch3.md describe the new split and that releases
  before 0.5.0 keep the license they were published under.

Every commit to Progmasoft's files since the fork is the maintainer's.

Claude-Session: https://claude.ai/code/session_01Ji7xZMYjc4zankoc7hGBE1

Version 1.1 left programs built with Progmasoft tools under MPL-2.0 duties
for the code the tools place in them, and left other cases unclear.
Version 2.0 adds a generated code permission, covers runtime and standard
libraries, compiler transformations, interfaces and examples, and settles
how a file is identified and how to tell recipients about source.

Every project SPDX expression moves to AdditionRef-Progmasoft-Exception-2.0.
The older texts stay, because released versions name them.

zizmor audits the workflows themselves for what makes a workflow
unsafe, and uploads what it finds to code scanning. Its first run here
found one thing, 11 times: a checkout that leaves the job's token in
the checked-out repository, where any later step can read it. No
workflow pushes or needs the token after the checkout, so every checkout
now sets persist-credentials to false, and zizmor reports nothing.

OpenSSF Scorecard grades how the repository is kept: branch protection,
pinned dependencies, token permissions and the like. It runs on the
default branch and weekly and uploads its findings to
code scanning.

Dependency Review fails a pull request that adds or changes a dependency
with a known vulnerability of high severity or worse. Dependabot watches
what is already there; this holds what comes in.

Every new action is pinned to a commit, each job names the permissions
it needs, and no new workflow has a default permission.

Two steps of the Windows build ran in the CMD shell, which zizmor cannot

read into; they run in PowerShell now, with the same commands and the

processor count taken from the environment.