docs: draft Stage 0/1 productization docs (registry wiring, invite walkthrough, LICENSE stub)

[Jess Sullivan (Jesssullivan)]

Status: DRAFT — pending operator review

None of the three files here are ratified answers. All carry an explicit
DRAFT — for operator review, not yet ratified. banner. No code changes,
no license grant is in effect, no bazel pattern is declared org policy —
this is documentation only, meant to give an operator something concrete to
react to.

What's in this PR

docs/registry-wiring-bazel.md (named to dodge this repo's bazel-*
.gitignore rule, which is meant for Bazel's own bazel-bin/bazel-out
output symlinks and was silently eating a file literally named
docs/bazel-registry-wiring.md):

• Documents a real contradiction: tinyland.dev (github/main, spot-checked
  at commit 98c619f) uses a per-module single_version_override in
  MODULE.bazel against the Tinyland registry, with .bazelrc left at
  bcr.bazel.build only. elders.tinyland.dev and several siblings instead
  add the Tinyland registry as a global .bazelrc search path ahead of
  BCR, with no override.
• Blesses the tinyland.dev pattern, since it's what the actual production
  consumer does today — but this is my read of existing code, not an
  existing ADR. Explicitly out of scope: migrating the other repos.

docs/invite-onboarding-walkthrough.md:

• Mint-invite → accept → provisioned admin → login, built on
  @tummycrypt/tinyland-invitation (the fail-closed authority TIN-1607
  adopted), cited against tinyland.dev's actual composition
  (src/lib/server/auth/invitation-service.ts).
• Explicitly warns readers OFF this repo's own exported InvitationService
  (src/modules/invitation) — TIN-2780 (status "In Review"): its
  createInvitation() does zero role-authorization; fix PRs fix(auth)!: remove duplicate invitation authority (TIN-2780) #33 and
  fix(invitation): drop ungated InvitationService from public surface (TIN-2780) #34 are open against this repo right now.
• Documents TIN-2781's current, more-current-than-the-original-finding
  state: the single-process TOCTOU race in acceptInvitation was fixed by
  tinyland-invitation#10 (merged 2026-07-11, per-token in-process mutex).
  The issue is deliberately kept open ("In Progress") because the fix does
  not cover cross-process/cross-replica compare-and-set — that's called
  out explicitly, along with a single-replica-only caveat on the whole doc.

LICENSE:

• package.json's license field is Zlib AND LicenseRef-Tinyland-Proprietary,
  but no LICENSE file existed and LicenseRef-Tinyland-Proprietary has no
  text anywhere in this repo or the org. Adds the real, unmodified Zlib
  license text plus a clearly marked, empty
  [PLACEHOLDER — proprietary terms not yet drafted] block for the other
  half. No proprietary legal text invented.

Residual risks / follow-ups for the operator

• TIN-2780 not yet merged — once fix(auth)!: remove duplicate invitation authority (TIN-2780) #33 or fix(invitation): drop ungated InvitationService from public surface (TIN-2780) #34 lands, re-check the invite
  walkthrough against whatever this repo's own invitation surface looks like
  post-fix (removed export vs. gated export changes some of the "don't use
  this" framing).
• The "blessed" bazel pattern is my read of tinyland.dev's own code at one
  commit, not an existing operator ADR. An actual ADR would firm this up and
  should also decide whether/when the global-registry repos migrate.
• LICENSE's proprietary half is a placeholder only — needs real legal text
  and a decision on which files/modules fall under which half of the SPDX
  expression before this can be treated as a real license.