Signetry Admission v0.5.0 — Apache-2.0, core@v0.8.0

Changed — licensing (open core)

• This Action is now open source under Apache-2.0. A real LICENSE file is in
  the repo root. The previous "All Rights Reserved" notice is withdrawn: you may
  use, fork, modify, distribute, and commercialize this Action, including in
  commercial and closed-source products, with no permission needed.
• Signetry moved to an open-core model: the whole integration surface (this
  Action, the editor/agent plugins, the pre-commit guard, the eval suite) is
  Apache-2.0, while the engine
  signetry-core is source-available under
  BUSL-1.1 and converts to Apache-2.0 on 2030-08-31. See
  LICENSING.md.
• The CLA is unchanged and still required. Open core needs relicensing rights
  so a contribution made here can later move into the engine; signing takes away
  none of the rights Apache-2.0 grants you. CLA.md, CONTRIBUTING.md,
  CONTRIBUTORS.md, and the docs were rewritten to say so accurately.
• The CLA's fallback licence grant is now non-exclusive. It previously granted the
  Owner an exclusive licence where copyright assignment is not permitted by law, which
  would have stripped contributors of the right to use their own contribution — directly
  contradicting the rights the LICENSE grants everyone. The CLA text is now identical
  across all Signetry repositories (bar the engine/integration licence wording) so the
  legal terms cannot drift per-repo again. See CLA.md §2–3.

Changed

• Default signetry-core install pinned to
  git+https://github.com/Signetry/core@v0.8.0 (was @v0.6.0 as of v0.4.0; an
  intermediate bump to @v0.7.0 landed on main and was never recorded here).
  v0.8.0 brings the receipt conformance spec + suite, the policy registry
  (signetry policies, signetry init --policy), and placeholder-provenance
  reporting, following the signetry-core v0.8.0 release.
• The advisory reviewer workflow installs signetry-reviewer@v0.3.0 (was @v0.2.0),
  following the signetry-reviewer v0.3.0 release.
• @v1 moved to this release.

Fixed

• MARKETPLACE.md advertised an exact pin that was two releases stale. The
  Marketplace listing told readers to "Pin @v1 (moving) or @v0.2.0 (exact)" long
  after v0.3.1 and v0.4.0 shipped, so anyone following it verbatim pinned an
  Action that predates the rename. It now names the current release.