v0.5.0 — OBSL 2.12 auth + startup compatibility preflight

Aligns the runner with OrionBelt Semantic Layer v2.12 unified authentication and pins the 0.5.x line to OBSL 2.12.x.

Authentication

• API key sent in X-API-Key by default — configurable via obsl.api_key_header / OBSL_API_KEY_HEADER (Authorization: Bearer stays a server-side fallback).
• New obsl.api_key spec field and OBSL_API_KEY env var (matches the OBSL UI / MCP). The pre-2.12 api_token / OBSL_API_TOKEN naming has been removed.
• 401 / 403 responses surface as ObslAuthError with OBSL's structured {code, message} and a hint about which key/header was sent.

Startup compatibility preflight

• orionbelt-runner run calls the unauthenticated GET /health before any query and verifies the server is in the supported 2.12.x line (distinct too-old / too-new messages) and that a key is configured when the server reports AUTH_MODE=api_key.
• Bypass with --skip-preflight.

Docs & licensing

• README: OrionBelt logo + badges, Authentication and Compatibility sections, License section with RALFORION footer.
• Added BSL 1.1 LICENSE (mirrors OBSL; converts to Apache 2.0 on 2030-03-16).

Compatibility: requires OrionBelt Semantic Layer 2.12.x.