chore: add Contributor License Agreement and roll the BUSL Change Date per release

[IAmBod]

Licensing groundwork before the repository goes public. No Go code changes.

Why

rss2msg is source-available under BUSL 1.1, with separate commercial licenses offered on top. Two gaps in that setup:

1. Contributions were licensed inbound under BUSL itself. CONTRIBUTING.md said contributions are licensed "under the same terms as the rest of the project" — which licenses the contributor's copyright to the project under BUSL, including its own no-hosted-service carve-out. The project would receive contributed code as a mere licensee, bound by its own restriction. That makes contributed code unusable in a commercial or hosted offering, and blocks the Apache-2.0 conversion each version is meant to get on its Change Date. It is also effectively unfixable after the fact — it means tracking down every past contributor.

2. The Change Date was a fixed constant. LICENSE carried 2030-06-01 and nothing in the release process touched it, but BUSL applies "separately for each version" and the Change Date "may vary for each version". Every version would have converted on the same day — a release cut in 2029 would get one year of protection instead of four, and anything released after 2030-06-01 would ship already converted.

What changed

CLA — CLA.md, adapted from the Apache Software Foundation Individual CLA v2.0. Contributors keep their copyright; the grant lets the project offer contributions under BUSL, under separate commercial licenses, and under Apache-2.0 at conversion. Signing is automated by .github/workflows/cla.yml (contributor-assistant/github-action@v2.6.1), which records signatures in a cla-signatures branch and never checks out PR code.

Change Date — the release procedure now rewrites the Change Date: line to four years out and stages LICENSE with CHANGELOG.md. Since the tag captures the tree, each tag and every artifact built from it carries the date belonging to that version. Four years is the ceiling, not a choice: BUSL converts on the Change Date or the fourth anniversary of first distribution, whichever comes first. Wired into both docs/development/releasing.md and the cut-release skill that /release drives. The legal text itself is untouched.

Wording — README.md and CONTRIBUTING.md now say "source-available" rather than implying open source; BUSL's field-of-use restriction is incompatible with the OSI definition. README also gains a Contributing section linking CONTRIBUTING / CODE_OF_CONDUCT / SECURITY, which it never had.

Also fixes a contradiction the Change Date step exposed: releasing.md still instructed adding [skip ci] to the changelog commit, which is what silently skipped the v0.3.0 release. The cut-release skill already forbids it.

Setup required before this can gate merges

Both are maintainer actions in repo settings, documented in the workflow header:

1. Create a PAT with repo scope (or fine-grained, Contents: read/write) and add it as the CLA_SIGNATURES_TOKEN secret. The default GITHUB_TOKEN cannot write the signature file, since that write happens outside the PR's ref.
2. Add a ruleset on main requiring the "CLA Assistant" status check, so an unsigned PR cannot be merged.

Note that this workflow does not run on this PR: pull_request_target executes the copy of the workflow file on the base branch, and main does not have it yet. It first takes effect on pull requests opened after this merges. Until step 1 is done it will run and fail there — but it is not a required check yet, so it blocks nothing.

Verification

• bash scripts/check-doc-links.sh → OK: all relative doc links resolve
• actionlint .github/workflows/cla.yml → clean; YAML parses
• The documented sed for the Change Date was run against a copy of LICENSE: changes exactly one line, preserves column alignment, 2030-06-01 → 2030-07-21
• No Go files touched, so task test / task vet are unaffected by this branch

🤖 Generated with Claude Code

https://claude.ai/code/session_01CtBEGzKLXr9iBXibFVKJHx

[IAmBod]

Superseded by #211, now merged — the same changes rebased onto current main (this branch had gone dirty). The duplicate contact-address commit was dropped since #204 landed it on main; the CLA docs it did not cover were realigned to info@iambod.dev in the rebase.