The security policy is read by people who report a flaw; its notice is for
tools. Codacy found the notice's acronyms undefined and the address in its
copyright line taken for personal data. The notice moves, unchanged, into
SECURITY.md.license, the sidecar file REUSE defines for this; the policy
starts with its title, and its reporting address stays where it was.
LICENSES/README.md says where the notice is.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ji7xZMYjc4zankoc7hGBE1

PATENTS.md and the License section of the README are wrapped at 80
columns, as the rest of Catch3's Markdown is and as Codacy's markdownlint
checks. The three Markdown files that came from Catch2 write their two
copyright lines and the license in one comment, so that no line passes 80.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ji7xZMYjc4zankoc7hGBE1

Every Progmasoft-authored file moves from MPL-2.0 WITH
AdditionRef-Progmasoft-Exception-2.0 to LGPL-3.0-or-later, from 0.5.0
on. Catch2-originated files keep BSL-1.0, and the vendored yyjson and
pugixml keep MIT.

- LICENSES/ holds the LGPL-3.0 text and the GPL-3.0 text it builds on,
  both as published by the FSF; the MPL-2.0 and Progmasoft Exception
  texts go, since no file uses them any more.
- Five files that came from Catch2 and were rewritten by Progmasoft
  (.clang-format, the issue and pull request templates, SECURITY.md)
  keep Catch2's notice next to Progmasoft's and say
  LGPL-3.0-or-later AND BSL-1.0.
- //tools:check expects the new header of Progmasoft files; the
  amalgamation notes say LGPL-3.0-or-later and the amalgamated files
  are regenerated; meson's project license is BSL-1.0 and
  LGPL-3.0-or-later.
- README gains a License section; LICENSES/README.md, contributing.md
  and progmasoft-catch3.md describe the new split and that releases
  before 0.5.0 keep the license they were published under.

Every commit to Progmasoft's files since the fork is the maintainer's.

Claude-Session: https://claude.ai/code/session_01Ji7xZMYjc4zankoc7hGBE1

Version 1.1 left programs built with Progmasoft tools under MPL-2.0 duties
for the code the tools place in them, and left other cases unclear.
Version 2.0 adds a generated code permission, covers runtime and standard
libraries, compiler transformations, interfaces and examples, and settles
how a file is identified and how to tell recipients about source.

Every project SPDX expression moves to AdditionRef-Progmasoft-Exception-2.0.
The older texts stay, because released versions name them.