Add the canonical license and project notice, declare the license in package metadata, and include both files in production images.
Pin the Rust toolchain and nextest profile so both service crates share a reproducible verification baseline.
