docs(release): Phase 3.1 — pre-public audit + in-turn fixes

Phase 3.1 closure per `docs/PUBLIC_RELEASE_PLAN.md` §6 row 3.1.
Read all 564 tracked files from an outsider's perspective; one
CRITICAL leak + one HIGH license inconsistency + one LOW dev-cruft
fixed in-turn. Three smaller items surfaced for user decision before
the Phase 3.4 public flip. Full audit trail in
`docs/PRE_PUBLIC_AUDIT.md`.

Fixed in-turn:

  CRITICAL — `.firecrawl/point72-{about,home,splunk-security-engineer}.md`
  were tracked in the repo: page-scrape artifacts from an employer-
  research session unrelated to wl_manager. Phase 0.10 secret-scan
  did not flag them (no credentials inside), but the outsider lens
  surfaces them immediately. Deleted from working tree, added
  `.firecrawl/` to `.gitignore` so the directory cannot be
  re-tracked by accident. (Git history retention is an open question
  surfaced to the user in PRE_PUBLIC_AUDIT.md.)

  HIGH — license inconsistency. Phase 0.6 (2026-05-15, commit e55e9ab)
  switched the project license from MIT to Apache 2.0 per locked
  decision D1, updating LICENSE + NOTICE files. Five downstream sites
  were missed at that time and still claimed MIT:
  - README.md badge:        License-MIT       → License-Apache_2.0
  - README.md License sect: "MIT License"     → "Apache License 2.0"
                                                + NOTICE pointer
  - docs/index.md License:  "MIT — see ..."   → "Apache License 2.0
                                                — see LICENSE and
                                                NOTICE"
  - mkdocs.yml copyright:   "MIT License"     → "Apache License,
                                                Version 2.0"
  - app.manifest license:   "name": "MIT"     → "name": "Apache-2.0"
  - sbom.cdx.json:          "id": "MIT"       → "id": "Apache-2.0"
  - sbom.cdx.json publisher:"Security Engineering" → "Oleh Bezsonov"
                                                (matches D5)
  Two intentional MIT mentions preserved: NOTICE (jQuery/Bootstrap
  third-party) and PUBLIC_RELEASE_PLAN.md (D1 + Phase 0.6 history).

  LOW — `test_py.py` at repo root (1 line, `print(123)`) was dev cruft
  from an early session. Removed.

Surfaced to user (PRE_PUBLIC_AUDIT.md "Open questions"):

  1. .firecrawl/ git-history sanitization decision (filter-repo
     before Phase 3.4 vs accept history)
  2. docs/superpowers/ disposition (leave / move to .planning/ /
     remove) — internal planning docs visible to outsiders, framed
     for agentic-worker audience
  3. .mcp.json.example Windows-path genericization (fix now vs
     defer to v1.1)

Items checked and PASSED (no finding):

  - Personal identity (communicate.oleh@gmail.com intentional per D15;
    wildleo91 only in D17 historical entry; commit emails via
    GitHub noreply)
  - Credentials (only Chang3d! dev default, allowlisted)
  - Internal infrastructure (all RFC1918 IPs trace to demo/sample/
    example data; no real ops)
  - Code red flags (zero TODO|FIXME|XXX|HACK in production)
  - Debug statements (only test_runner.xml, hidden dashboard)
  - Required files (LICENSE, NOTICE, README, CONTRIBUTING,
    CODE_OF_CONDUCT, SECURITY, CHANGELOG, screenshots)
  - CI workflows (private-repo guard correctly applied to
    codeql/scorecard/docs deploy)

Doc-drift: passes (31 docs / build 660).

Author: RelativisticJet

.firecrawl/point72-about.md

@@ -163,3 +163,9 @@ tests/a11y/reports/
 # MemPalace per-project files (issue #185)
 mempalace.yaml
 entities.json
+
+# Firecrawl scratch — page scrapes from research/competitor-analysis
+# sessions land here; not project content. Phase 3.1 pre-public audit
+# removed 3 unrelated career-page scrapes that had been accidentally
+# tracked (2026-05-18).
+.firecrawl/

.firecrawl/point72-home.md

@@ -6,7 +6,7 @@
   the correct signal for an unreleased app. Do NOT hardcode the version here.
 -->
 [![Version](https://img.shields.io/github/v/release/RelativisticJet/wl_manager?label=version&color=blue)](https://github.com/RelativisticJet/wl_manager/releases)
-[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+[![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-green.svg)](LICENSE)
 [![Splunk](https://img.shields.io/badge/Splunk-9.3-orange.svg)](https://www.splunk.com/)
 [![Python](https://img.shields.io/badge/Python-3.9+-yellow.svg)](https://www.python.org/)
 [![Docs](https://img.shields.io/badge/docs-relativisticjet.github.io%2Fwl__manager-blue?logo=readthedocs&logoColor=white)](https://relativisticjet.github.io/wl_manager/)
@@ -246,7 +246,7 @@ make package          # Outputs dist/wl_manager-VERSION.spl
 
 ## License
 
-MIT License. See [LICENSE](LICENSE) for details.
+Apache License 2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE) for details.
 
 ## Contributing
 

.firecrawl/point72-splunk-security-engineer.md

@@ -25,7 +25,7 @@
     },
     "commonInformationModels": null,
     "license": {
-      "name": "MIT",
+      "name": "Apache-2.0",
       "text": null,
       "uri": "https://github.com/RelativisticJet/wl_manager/blob/main/LICENSE"
     }