Prepare Stack CLI for public source

[konojunya]

Background

Stack CLI is moving from a private coordination boundary to a free, open-source command-line tool. The repository needs a complete source-license, dependency, contribution, security, and publication audit before its GitHub visibility can change.

Implementation

• license repository-authored work under Apache-2.0 and add the repository notice
• replace the obsolete private licensing gate with an exact runtime/build dependency inventory
• document contribution and private vulnerability-reporting boundaries
• record a publication audit covering history, GitHub surfaces, dependencies, assets, and branch protection
• remove authenticated and proprietary-theme delivery from the CLI roadmap
• pin Stack Engine 0.3.0 and its current compiler/theme revisions
• expose the Engine 0.3 actionable diagnostic expected and help fields in CLI output
• keep publish = false; this change does not publish a supported binary release

Verification

• Gitleaks 8.30.1 full-history and working-tree scans: no leaks
• cargo +stable fmt --check
• cargo +stable test --locked (27 tests)
• pinned specification formatter conformance
• cargo +stable clippy --all-targets --all-features --locked -- -D warnings
• RUSTDOCFLAGS='-D warnings' cargo +stable doc --no-deps --locked
• coverage: 91.10% regions, 98.48% functions, 93.15% lines
• stable release build, SVG validation, and command metadata smoke tests
• Rust 1.85 tests and Clippy
• resolved dependency license metadata audit
• git diff --check

Review focus

• confirm the Apache-2.0 boundary and dependency inventory are sufficient for public source
• confirm no private/authenticated delivery promise remains
• confirm a future binary release remains separately gated on shipping exact applicable notices
• after merge, the manager repository will declaratively add public visibility, private vulnerability reporting, and required baseline / Minimum supported Rust checks before applying the visibility change