[codex] chore: add live-safe OSS readiness pass

[Vasanthdev2004]

Summary

This PR adds a live-safe OSS readiness and maintainer pass for the already-running Gitlawb node network.

Key changes:

• Adds docs/OSS-READINESS-AUDIT.md with build/test health, Docker/self-hosting readiness, security/trust boundaries, CLI/CI/release notes, and live-network priorities.
• Adds docs/MAINTAINER-ROADMAP.md so maintainers and contributors have a clear node-focused roadmap.
• Stages peer-route hardening without breaking current live nodes: upgraded nodes sign peer announce/sync traffic, receivers verify the DID when a signature is present, and strict enforcement remains opt-in via GITLAWB_REQUIRE_SIGNED_PEER_WRITES=false.
• Moves bounty dispute behind HTTP Signature auth.
• Fixes installer/release alignment for Gitlawb/node release assets.
• Corrects Docker/env/docs details around bootstrap peers, GHCR image name, Rust version, missing keeper workflow claim, and current private-read limitations.
• Updates the CLI user agent to report the crate version.

Live-network rollout note

Gitlawb nodes are already live, so this PR intentionally avoids requiring signed peer writes by default. Operators can leave GITLAWB_REQUIRE_SIGNED_PEER_WRITES=false during rolling upgrades, then flip it after known peers are updated.

GraphQL POST is also left compatible for now; the audit calls out mutation-aware auth as a live-network priority.

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• cargo build --release -p gitlawb-node -p gl -p git-remote-gitlawb
• docker compose config
• git diff --check

Could not run a full Docker image build locally because Docker Desktop's Linux engine pipe was unavailable in this environment.

[Vasanthdev2004]

Found and fixed one rollout issue in 8bdc1c7.

Issue:

• The PR claimed peer announce/sync writes would verify signatures when present while allowing unsigned legacy peers during rollout.
• But in non-strict mode the auth middleware was not installed, so signed peer requests were never parsed and AuthenticatedDid was always None.
• That meant mismatched signed peer announce/notify requests would not be rejected until GITLAWB_REQUIRE_SIGNED_PEER_WRITES=true.

Fix:

• Added auth::optional_signature middleware.
• In rollout mode it verifies RFC 9421 signatures when Signature-Input/Signature headers are present.
• If no signature attempt is present, legacy unsigned peer writes still pass.
• Strict mode still uses auth::require_signature.

Validation:

• cargo fmt --all -- --check
• cargo check --workspace
• cargo test --workspace — 291/291 passing
• cargo clippy --workspace --all-targets -- -D warnings
• git diff --check

After this fix, the PR looks good functionally. It is still marked Draft, so flip it ready-for-review when Kevin/Anand should review.

[Vasanthdev2004]

Marked this ready for review.

@anandh8x @kevincodex1 please review when you get a chance. I fixed the peer-signing rollout issue in 8bdc1c7; current validation is clean:

• cargo fmt --all -- --check
• cargo check --workspace
• cargo test --workspace — 291/291 passing
• cargo clippy --workspace --all-targets -- -D warnings
• git diff --check

[Vasanthdev2004]

Updated the README in 7cb2978.

What changed:

• Repositioned Gitlawb Node around decentralized git infrastructure + app/code CDN direction.
• Added a clear repo/crate table for gitlawb-node, gl, git-remote-gitlawb, and gitlawb-core.
• Added current status and known limitations so operators understand what is live vs staged.
• Reworked quickstart, CLI install, first repo flow, architecture, API surface, configuration, staking, build/test, macOS app, roadmap, and contributing sections.
• Added the “code should not disappear because one server went down” mission into the README.

Validation:

• git diff --check
• cargo check --workspace

PR remains ready for review and mergeable.

[kevincodex1]

LGTM