fix(w0): publish blockers — secret hygiene, license attribution, contact scrub

[hellno]

W0 — publish blockers (hard gate before flipping public)

Pre-publication hardening: full-history secret scan, license attribution, and contact scrub.
DoD verified green (see below).

1. Secret hygiene

• Full-history scan (260 commits, all refs): gitleaks 8.30.1 + trufflehog 3.95.5
  (--no-verification, so already-revoked keys still surface) + a custom 32-alnum Alchemy
  pattern over git rev-list --all.
• Result: exactly one real secret — a live Alchemy API key hardcoded in
  crates/deckard-signerd/tests/shield_e2e.rs. One false positive (a redact_url test
  fixture). Notable: gitleaks' default ruleset missed the key (no Alchemy rule); the
  custom pattern + trufflehog caught it — a custom gitleaks rule is saved for CI reuse.
• Fix: removed the literal; RPC_URL_SEPOLIA is now required — the test fails with
  an actionable message (the env line + re-run command) when unset.
• 🔴 Human action: revoke the leaked key in the Alchemy dashboard (a scrub does not
  invalidate an exposed key). The git-history purge of the key (83 trees) is a separate,
  authorized destructive op (backup taken; codex integrity-reviewed; force-pushed).

2. Contact scrub

• The maintainer's personal email was in 5 docs (CODE_OF_CONDUCT, CONTRIBUTING, README,
  SECURITY, RELEASING — 7 occurrences). Replaced everywhere with GitHub private
  vulnerability reporting (no email published anywhere). Commit metadata was already clean
  (noreply addresses only). The email is also purged from git history in the same rewrite.

3. License resolution

• vendor/eip-1193-provider had no LICENSE file and no license field. Added a LICENSE
  (MIT text + verbatim-fork provenance) and license = "MIT".
• NOTICE now attributes kohaku's eip-1193-provider (vendored) + railgun + common
  (linked into the shipped binary via deckard-core's default-on shield feature).
• Provenance (verified via GitHub API): kohaku declares "license": "MIT" in its root
  package.json but ships no LICENSE file and no per-crate field. The MIT text is
  reproduced; MIT is AGPL-compatible. 🟡 Maintainer action: confirm MIT directly with the
  kohaku maintainers before/shortly after publishing.

Definition of Done

• ✅ cargo fmt --all --check clean
• ✅ clippy -D warnings — workspace (all-targets) and --features tray: 0 warnings
• ✅ cargo test --workspace green (network e2e tests correctly #[ignore]d)
• ✅ no dependency changes (Cargo.lock unchanged; --locked held)
• ✅ codex (GPT-5) adversarial review: W0 ACHIEVED, all 3 goals PASS, no shortfalls

🔴 Human-only blocker (cannot be done by the agent)

• Name / domain / handle / trademark check — still queued per the launch pitch. Must be
  cleared before the flip; renaming after launch burns earned links.

Scan report, history-purge runbook, and backup location: .context/w0-scan/ (gitignored).