Owen Alpha gate: choose license, configure protected release environments, and approve version

[PhysShell]

Parent: #250

Owner gate with a medium-agent verification packet. No publication in this issue.

Goal

Resolve the repository-owner decisions that intentionally remain outside PRs #247/#248, so the existing release workflows can be used safely.

Owner decisions

1. Choose the repository/package license.
2. Choose the first public Owen alpha version.
3. Configure the protected GitHub Environments:
   • nuget-release;
   • action-major-tag-move.
4. Add the NuGet publication secret.
5. Confirm who may approve each protected deployment.

Deliverable

Repository/license

• Add a root LICENSE file.
• Add the matching NuGet license metadata.
• Ensure README/package documentation states the alpha status and license accurately.
• Do not change internal assembly/project naming merely for branding symmetry.

nuget-release Environment

Configure:

• at least one required reviewer;
• deployment restrictions appropriate for the release-tag workflow;
• NUGET_API_KEY as a protected secret;
• no bypass path that allows an unreviewed publication.

action-major-tag-move Environment

Configure:

• at least one required reviewer;
• manual-only use through the existing workflow;
• no automatic movement of v0/v1 as a patch-tag side effect.

Version decision

Record:

• first CLI version;
• corresponding CLI tag owen-cli-vX.Y.Z;
• first immutable Action tag vX.Y.Z;
• compatibility statement limited to the existing 0.x alpha contract.

Verification

• Run the existing fixture-driven Environment predicate tests.
• Run a read-only/manual preflight proving GitHub's API reports a non-empty required_reviewers rule for both Environments.
• Verify the package metadata and tag/version comparison without publishing.
• Re-check that Owen.Cli remains available immediately before the first release.

Guardrails

• No package publish.
• No Action major-tag move.
• No secret value in logs, issues, commits or PR bodies.
• No license chosen by an agent without the owner's explicit decision.
• No Rust migration work.
• No new compatibility promise beyond alpha.

Acceptance

• Root LICENSE exists and package metadata agrees with it.
• Both Environments exist and expose at least one required reviewer through the GitHub API.
• NUGET_API_KEY exists only as a protected secret.
• First version and tag namespaces are recorded.
• Release workflows remain gated and green.
• The next release issues are unblocked, but nothing has been published yet.