public-readiness: scrub internal details, split licensing, hosted kernel-build

Preparing the repo to go public (ADR-0007):

- CI: kernel-build moves from the self-hosted runner to ubuntu-latest
  (installs its own cross toolchain + qemu, caches the pristine tarball).
  On a public repo a registered self-hosted runner is reachable from
  approved fork-PR workflows — i.e. arbitrary code on private
  infrastructure — and the build never actually needed the SDK host.
  ADR-0004 marked superseded-in-part; docs/ci-cd.md rewritten (site
  specifics now live only in the private deployment log).
- Licensing: LICENSE gains the GPL-2.0 carve-out for patches/ and the
  kernel source excerpts (Linux derivatives; per-driver provenance was
  already tracked in PROVENANCE.md); patches/README.md states it too.
- Scrubbed from the tip: bench-unit dev credentials and its gadget IP
  (m2-boot notes), the site AP SSID+BSSID and a neighboring AP's BSSID
  and the device WLAN MAC (wifi bring-up evidence — BSSIDs are
  geolocatable), the runner mesh IP. NOTE: these remain in git history;
  decision on a pre-publication history rewrite is separate.
- Emoji cleanup across 21 tracked files (kernel port docs, review report,
  enforce-mcdc.sh) per repo text conventions: status marks became
  [x]/[wip]/[ ]/OK plain text.
- "[maintainer]-gated" process phrasing normalized to "maintainer-gated"
  (attributions in dated evidence docs kept).

Verified: zero emojis tracked; scrub grep clean; patches carry no internal
references; ci.yml parses; shellcheck unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

kernel/rv1106-enablement/rng-otp/PORT-DONE.md

@@ -1,6 +1,6 @@
 # TRNG + OTP port (batch A) — 6.18
 
-## TRNG (hardware RNG) — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+## TRNG (hardware RNG) — VERIFIED on warden-c8a3 (2026-08-25)
 rv1106's `rockchip,trngv1` is the same standalone TRNG_V1 IP as rk3588 (identical
 register map). Mainline `drivers/char/hw_random/rockchip-rng.c` already drives it.
 
@@ -21,7 +21,7 @@ rv1106's clock/reset names need no special handling.) Kconfig
 `dd if=/dev/hwrng bs=16` → `c697 503d f9db 6b84 50e4 e1ee f232 b2ae` (real HW
 entropy, non-zero). Hardware entropy source for the panel's crypto/keys.
 
-## OTP / nvmem — ✅ VERIFIED on warden-c8a3 (2026-08-25)
+## OTP / nvmem — VERIFIED on warden-c8a3 (2026-08-25)
 Reads real data: `dd .../rockchip-otp0/nvmem bs=1 count=16 | xxd` →
 `5211 02fe 084d 5231 0000 0000 3b15 0000` (contains "MR1" chip id) — no timeout.
 Mainline `drivers/nvmem/rockchip-otp.c` gains an `rv1106_data` + compatible.