Public by design: stale 'NEVER make public' description + license-hygiene pass

[aarontrowbridge]

Context

Per Aaron (2026-08-20): this repo is intended to be public. The current description ends with "NEVER make public (upstream MIT attribution preserved)" — a stale instruction that now contradicts the actual posture and should not survive where it will confuse the next person (or agent) making a visibility call.

Findings (checked 2026-08-20)

• LICENSE at root is byte-identical to upstream anomalyco/opencode — MIT, Copyright (c) 2025 opencode preserved. Attribution requirement: met.
• GitHub's license detection nonetheless reports spdxId: none on this repo (upstream detects as clean MIT) — likely an indexing artifact since this is a standalone repo, not a GitHub-fork-button fork. Cosmetic, but worth a nudge (re-push or contact support) so the license badge renders.
• AMICODE-PATCHES.md documents the patch discipline; the L1/L2/L3 patches are therefore public-facing by the same intent.

Actions

• Update the repo description: drop "NEVER make public", keep the patch-discipline note (suggested: "Amicode's thin fork of opencode — L1 branding + L2 renderer slot + L3 Amico components on v1.17.3. Patch discipline: AMICODE-PATCHES.md. Public by design; upstream MIT preserved.")
• Nudge GitHub license detection so the MIT badge renders (often fixed by any push touching the file or via support form).
• One-time audit now that public-by-design is explicit: confirm nothing in the patch history (pre-fork baseline through today) contains secrets or not-for-public material — git log -p -- LICENSE .github spot-check + a secret-scan pass (gitleaks config already present via .gitleaksignore).

Non-goals

No license change — the MIT text stays verbatim upstream. No visibility change — it stays public.