v0.43.0

v0.43.0

Highlights:

• Source-level blanket licences, for sources that publish one. 10 of 17 sources
  state no licence at all, and answering "all rights reserved" for an archive
  whose operator has dedicated the whole thing is a wrong answer, not a safe
  one. pdb is CC0-1.0 (the wwPDB dedicates the archive; entries carry no licence
  field) and uniprot is CC-BY-4.0 (every UniProtKB flat-file record states it
  in-band, a notice the JSON our adapter reads drops). Applies only when the
  record itself is silent — a licence on the record always wins — and the
  verdict says where the licence came from. gwas is deliberately excluded:
  individual studies carry their own Usage License, so a blanket default would
  be wrong precisely where it matters.

• The README now documents the streamable HTTP transport: --transport http and
  every flag with it, the /mcp/ endpoint and the 307 that /mcp redirects with,
  the always-on DNS-rebinding rules, and that fetch(dest=...) writes to the
  server's filesystem rather than the caller's. Plus four environment variables
  the code read but nothing documented. The transport shipped in 0.42.0 but
  appeared nowhere someone installing from PyPI would look.

Fixes:

• NCBI pacing now follows the request host, not the service label. GEO's
  supplementary-file listing fetches from ftp.ncbi.nlm.nih.gov under the label
  "GEO suppl listing", which failed a startswith("NCBI") test, so it drew from
  the default bucket at 10 req/s — over three times NCBI's keyless ceiling —
  purely because of what the call was named. Honest scope note: this was found
  while triaging an intermittent GEO 403 and does not demonstrably fix it; that
  403 never reproduced in isolation. The pacing gap is a real defect on its own
  terms, but the causal link is unproven.

• A Creative Commons licence stated without a version is no longer discarded.
  CC 2.0/3.0/4.0 differ on attribution and on the effect of a DRM clause, so
  picking one would be a fabrication; identify_cc_family reports "family known,
  version not" as a third outcome instead of throwing the information away.