Add a link check named verify, and licence the notes CC BY 4.0

[robertblust]

Closes the two gaps left when the repo was created.

verify

The one failure this repo can have that looks like success: the README lists the notes, each note is a file, and a rename leaves a link that renders perfectly and 404s when clicked. Nothing on the page says so, and the person who finds out is a stranger who came here for an answer.

verify.py resolves every relative link in every note. Run it locally with python3 verify.py.

External URLs are deliberately not fetched. A checker that hits the network fails on someone else's outage, and a suite that cries wolf is one people stop reading.

Tested in both directions before committing — a check that only ever passes proves nothing:

$ printf '\n- [broken](notes/does-not-exist.md)\n' >> README.md
$ python3 verify.py
✗ 1 broken link(s):
  README.md -> notes/does-not-exist.md
exit=1

$ git checkout README.md && python3 verify.py
✓ 1 relative link(s) resolve
exit=0

The job is named verify to match the context the sibling repositories' rulesets require. That name is load-bearing: renaming the job turns the protection off silently, because the rule waits for a context nothing reports. There is a comment in the workflow saying so.

Licence

CC BY 4.0, canonical text from GitHub's licence API.

Apache 2.0 is what the code repositories carry, and it is written for code. The artefact here is prose, so this is a content licence. Public with no licence at all meant all rights reserved — the opposite of the point of writing these down.

Order of operations

The required_status_checks rule is not in this PR. It goes on the ruleset after this merges, so the check exists before it is required — adding it first would block this very PR against a context nothing had yet reported.

Right now protect-main carries deletion, non_fast_forward and pull_request. After merge it will match the siblings exactly.