Relicense under PolyForm Noncommercial, add CI badges and testing docs

[TenOfNine]

Summary

• Add LICENSE (PolyForm Noncommercial License 1.0.0) — free to use, modify, and self-host for any noncommercial purpose; commercial resale/offering as a paid service requires a separate agreement with the copyright holder. Vendored front-end assets (Bootstrap, jQuery, Chart.js) keep their own original MIT licenses.
• Add a status badge row to the README (CI, CodeQL, license, .NET version, tests) and a new Testing section documenting the current xUnit results (62/62 passing) and what each CI workflow checks.
• Add two further CI/CD workflows:
  • codeql.yml — CodeQL static analysis for C#, on every PR/push to main plus a weekly schedule.
  • dependency-review.yml — fails PRs that introduce dependencies with high-severity vulnerability advisories.
• Bump the technical specification to v1.2 documenting the license change and the two new CI/CD workflows.

Test plan

• dotnet build -c Release — succeeds, 0 warnings/errors
• dotnet test -c Release — 62/62 passing
• CI (ci.yml, codeql.yml, dependency-review.yml) runs green on this PR

---

Generated by Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/dependency-review.yml

Package	Version	License	Issue Type
actions/checkout	4.*.*	Null	Unknown License
actions/dependency-review-action	4.*.*	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	4.*.*	🟢 6.9	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches
actions/actions/dependency-review-action	4.*.*	🟢 7.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 20 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 9 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool detected but not run on all commits

Scanned Files

• .github/workflows/dependency-review.yml

[TenOfNine]

Checked, looks good/as expected.