v0.3.0 — hybrid fabric: BIG-IP + NGINX App Protect as live enforcemen…

…t points

Merge pull request #41 from henleda/quality-0.2.0 (0.2.0 quality pass)

0.2.0: security & correctness quality pass, --url estate fix, UI simplification

chore: open-source prep — Apache-2.0 license, contributor/security do…

…cs, scrub identifiers

- LICENSE (Apache-2.0) + NOTICE (with an F5 non-affiliation/trademark note)
- CONTRIBUTING.md (offline dev/test flow, add-a-control via the registry, safety expectations)
- SECURITY.md (dual-use / authorized-use-only, private disclosure, guardrails)
- pyproject: license = Apache-2.0, authors, keywords, classifiers, project URLs
- README: CI/license/python badges + Contributing / Security / License sections
- .env.example: complete + value-free — documents the optional tuning vars
  (CHANGE_CONTROL_DAYS, XC_DASHBOARD_URL, VPCOPILOT_* defaults + safety knobs); dropped unused XC_TENANT
- scrub: genericized the personal tenant namespace (d-henley -> test-ns) in test fixtures and the
  personal GitHub slug in user-facing examples (henleda/nimbus-demo -> octocat/hello-world / <owner>/…)

No secrets were ever tracked (.env is gitignored). 108 tests pass, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>