docs: add MIT LICENSE and state the licence in the README (closes #102)

The repository had no licence file at all, which makes publicly readable
code all-rights-reserved by default: nobody may legally use it. That is a
1.0 blocker rather than a nicety, and `LICENSE` was the only file from
`REPO_POLICIES.md`'s required minimum still missing here.

The choice is standing org policy rather than a per-repo call: any public
repo lacking a licence gets MIT, while a private repo with no licence is
already all-rights-reserved and needs nothing. `sneak/dnswatcher` is
public, so MIT.

`LICENSE` carries the canonical MIT text byte-for-byte with only the
copyright line filled in; no clauses added, removed, reworded, or
reflowed. `README.md`'s first line now names the licence, which the
Description requirement in `REPO_POLICIES.md` calls for, and the License
section states MIT and points at the file instead of recording the
decision as pending.

TODO.md

@@ -18,13 +18,29 @@ iterative resolver implementation with hermetic mocked tests.
 
 # Next Step
 
-Policy scaffold commit: add LICENSE, REPO_POLICIES.md, .editorconfig,
-.dockerignore, and .gitea/workflows/check.yml, and add the missing
-fmt-check, docker, and hooks targets to the Makefile. One commit, then
-confirm make check still passes.
+Add the README sections required by policy (Description, Getting Started,
+Rationale, Design, TODO, License, Author) if any are still missing.
 
 # Completed Steps
 
+- 2026-08-10: MIT `LICENSE` added at the repository root, closing the
+  last gap in `REPO_POLICIES.md`'s required-minimum file list and
+  removing the all-rights-reserved default that would otherwise have
+  shipped with a 1.0 tag. The licence choice is the standing org policy
+  (any public repo lacking a licence gets MIT; a private repo with no
+  licence is already all-rights-reserved), and this repo is public. The
+  file holds the canonical MIT text byte-for-byte with only the
+  copyright line filled in (`Copyright (c) 2026 sneak`); no clauses were
+  added, removed, or reflowed. `README.md`'s first line now names the
+  licence, as the Description requirement demands, and the License
+  section states MIT and points at the file instead of saying the choice
+  is pending. `make fmt` covers only Go sources (`gofmt -s`,
+  `goimports`), so it cannot reflow `LICENSE`
+- 2026-08-10: the policy scaffold (`REPO_POLICIES.md`, `.editorconfig`,
+  `.dockerignore`, `.gitea/workflows/check.yml`, and the `fmt-check`,
+  `docker`, and hooks Makefile targets) is present; it landed piecemeal
+  across the scripts-to-rule-them-all and policy commits rather than as
+  the single commit this file once planned
 - 2026-08-10: Go's test cache disabled for `script/test` via `-count=1`,
   so every invocation actually executes. A cached pass replays an
   earlier run's output without querying DNS at all, which in this repo
@@ -90,8 +106,6 @@ confirm make check still passes.
 
 Compliance:
 
-- Add README sections required by policy (Description, Getting Started,
-  Rationale, Design, TODO, License, Author) if any are missing
 - Pin Dockerfile base images by sha256 and ensure the Docker build runs
   make check