Fix the defects found by the live end-to-end run, add RC-017

- Close stdin for ssh, git, curl and the framework scripts, so a real ssh
  no longer swallows answers meant for later prompts.
- Count LICENSE and LICENSE + README.md (what Gitea creates) as content
  the script made, so a partly created repository can be reused.
- Document the observed token scopes (write:user for user-owned Gitea
  repositories) and the Gitea README.md in the README.
- Correct criterion 2 of MIL-002 (new Proposed version row).
- Record the run and the final security review as RC-017.
- Tests: stdin regression, initial_only reuse, other files count as
  content, example config needs its address edited.

Task: MIL-003#6
Task: MIL-002#1
Refs #20

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/lib/steps.sh

@@ -45,7 +45,7 @@ report_outcome() {
     say "The project is in ${PROJECT[directory]}. Nothing was committed there: review it, then work on a branch."
   else
     say "To continue: fix the problem named above and run the same command again with --apply."
-    say "A repository this run created is still empty (or holds only the license), so the next run offers to reuse it."
+    say "A repository this run created is still empty (or holds only the license and the README Gitea adds), so the next run offers to reuse it."
     say "A directory, remotes and submodule created so far are used again by the next run; you are asked before an existing directory or file is touched."
     say "Nothing is deleted automatically. To start over, delete the repositories above in the web interface and the project directory by hand."
   fi