Fix the defects found by the live end-to-end run, add RC-017

- Close stdin for ssh, git, curl and the framework scripts, so a real ssh
  no longer swallows answers meant for later prompts.
- Count LICENSE and LICENSE + README.md (what Gitea creates) as content
  the script made, so a partly created repository can be reused.
- Document the observed token scopes (write:user for user-owned Gitea
  repositories) and the Gitea README.md in the README.
- Correct criterion 2 of MIL-002 (new Proposed version row).
- Record the run and the final security review as RC-017.
- Tests: stdin regression, initial_only reuse, other files count as
  content, example config needs its address edited.

Task: MIL-003#6
Task: MIL-002#1
Refs #20

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/test-local.sh

@@ -217,13 +217,13 @@ test_an_existing_hooks_path_is_not_replaced_without_a_yes() {
 
 test_a_global_hooks_path_is_reported_not_changed() {
   setup_hosts
-  git config --file "$WORK/gitconfig" core.hooksPath /somewhere/global-hooks
+  git config --file "$WORK/gitconfig" core.hooksPath global-hooks-dir
   local dir="$WORK/project"
   local_answers "$dir" y n
   run_apply "$LOCAL_ANSWERS"$'y\n'
   assert_status "apply" 0 "$STATUS"
-  assert_contains "warns" "$ERR" "your global core.hooksPath is '/somewhere/global-hooks'"
-  assert_eq "the global setting is untouched" "/somewhere/global-hooks" "$(git config --file "$WORK/gitconfig" --get core.hooksPath)"
+  assert_contains "warns" "$ERR" "your global core.hooksPath is 'global-hooks-dir'"
+  assert_eq "the global setting is untouched" "global-hooks-dir" "$(git config --file "$WORK/gitconfig" --get core.hooksPath)"
   assert_eq "the project has its own" "framework/githooks" "$(project_git "$dir" config --local --get core.hooksPath)"
 }