Fix the defects found by the live end-to-end run, add RC-017

- Close stdin for ssh, git, curl and the framework scripts, so a real ssh
  no longer swallows answers meant for later prompts.
- Count LICENSE and LICENSE + README.md (what Gitea creates) as content
  the script made, so a partly created repository can be reused.
- Document the observed token scopes (write:user for user-owned Gitea
  repositories) and the Gitea README.md in the README.
- Correct criterion 2 of MIL-002 (new Proposed version row).
- Record the run and the final security review as RC-017.
- Tests: stdin regression, initial_only reuse, other files count as
  content, example config needs its address edited.

Task: MIL-003#6
Task: MIL-002#1
Refs #20

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/lib/http.sh

@@ -71,7 +71,7 @@ http_request() {
   # that never contains the request.
   HTTP_STATUS="$(curl --silent --max-time "$HTTP_TIMEOUT_SECONDS" \
     --connect-timeout 10 --output "$out_file" --write-out '%{http_code}' \
-    --config "$config_file" "${data_args[@]}" 2>/dev/null)" || curl_status=$?
+    --config "$config_file" "${data_args[@]}" </dev/null 2>/dev/null)" || curl_status=$?
   # The configuration file holds the token and the body may hold another one
   # (the mirror password): remove both now instead of at exit.
   rm -f -- "$config_file" ${body_file:+"$body_file"}