chore(license): attribute Mantis and Pi and refresh the docs

Add the final Mantis and Pi notices, license copies, acknowledgements, and residual copyright updates.

Update the README, maintained documentation, contributor guidance, and hand-maintained mirrors to describe Agentic
SAST, reconciliation, the Miscellaneous lane, current CLI behavior, and the final release contract. Correct stale
workspace and container guidance and annotate long-standing internals for maintainers.

apps/cli/src/commands/logs.ts

@@ -148,10 +148,10 @@ export function tailUntilComplete(logFile: string, opts: TailOptions = {}): Prom
   return new Promise((resolve) => {
     let position = 0;
     const completion = new LogCompletionState();
+    const completionDecoder = new StringDecoder('utf8');
     let done = false;
     const controller = new AbortController();
     let watcher: ReturnType<typeof watch> | undefined;
-    const completionDecoder = new StringDecoder('utf8');
 
     /** Output any new content appended since the last read. */
     function flush(): boolean {

apps/cli/src/docker.ts

@@ -448,8 +448,9 @@ export function spawnWorker(opts: WorkerOptions): ChildProcess {
   args.push(...opts.envFlags);
 
   // Container settings. Chromium's own sandbox needs syscalls Docker's default seccomp
-  // profile blocks, so it is loosened for the in-container browser automation; the
-  // worker process itself is not granted any extra privilege by this.
+  // profile blocks, which is why the profile is dropped. `seccomp=unconfined` is a
+  // container-wide setting, not a per-process one: every process here runs unfiltered,
+  // the worker included — not just the browser automation that motivates it.
   args.push('--shm-size', '2gb', '--security-opt', 'seccomp=unconfined');
 
   // Image