package: ship the annotation that licenses the shipped README

[thedavidmeister]

Closes #171

.soldeerignore excluded /REUSE.toml from the published package. REUSE.toml
is the only thing that licenses README.md — grep -c SPDX README.md is 0 —
and README.md ships. So every published rain-factory revision carries a file
with no license declaration anywhere inside it, in a tree the consumer cannot
edit.

Reproduced on both sides, not inferred. forge soldeer push --dry-run in this
branch's worktree now writes REUSE.toml into the zip beside README.md,
LICENSE, LICENSES/, src/ and test/; before this change the zip had no
REUSE.toml. Running reuse lint over a synthetic consumer holding the package
under dependencies/rain-factory-0.0.0/:

=== before ===
# MISSING COPYRIGHT AND LICENSING INFORMATION
* .../dependencies/rain-factory-0.0.0/README.md
* Files with copyright information: 22 / 23
* Files with license information: 22 / 23
Unfortunately, your project is not compliant with version 3.3 of the REUSE Specification :-(
=== after ===
* Files with copyright information: 23 / 23
* Files with license information: 23 / 23
Congratulations! Your project is compliant with version 3.3 of the REUSE Specification :-)

README.md is the sole offender before and the only file the annotation is
needed for; the nested LICENSE and LICENSES/ are already found by the tool.
The annotation paths that do not ship (audit/**/, flake.nix, …) do not error
— an unmatched annotation path is not a REUSE violation.

.soldeerignore is also the file #144 and #172 edit, one entry each. Each of
the three stands alone; #144 adds a line where this one removes one, so
whichever merges second needs a trivial conflict resolution.

QA

• Discriminating tests: n/a - what the publish step packages is not reachable
  from the forge suite. The discriminating evidence is the pair of reuse lint
  runs above, which differ only by the presence of the file this PR ships.
• Mutations applied: n/a - no src/ or test/ change, so there is no behaviour
  to mutate.
• Oracle: reuse 6.x itself over a real consumer-shaped tree, and the zip
  forge soldeer push --dry-run actually produces, rather than reading the
  ignore list and reasoning about it.
• Category check: the issue asks for (A) the shipped README.md having no
  license declaration; covered A. I checked the general form too - of the
  sixteen paths REUSE.toml annotates, README.md is the only one that also
  ships today, so shipping the annotation file closes the class, not just the
  one instance. The parallel-lists drift that lets a future REUSE.toml entry
  repeat this is [F56] [INFO] .soldeerignore and REUSE.toml are parallel hand-maintained lists of the same non-source file set, and only one of the two fails loudly when it falls behind #160's subject and is untouched here.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 39 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ccd61f5b-54dd-4945-b1bc-0c5d4a5ca2a3

📥 Commits

Reviewing files that changed from the base of the PR and between 710dff5 and 58cd4c2.

📒 Files selected for processing (1)

• .soldeerignore

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}