license: add LICENSE + retain wasmsign2 (MIT) attribution — derivative-work compliance gap

[avrabe]

A lineage/attribution review (while crediting origins on pulseengine.eu) surfaced a compliance gap.

What

sigil began as a takeover of jedisct1/wasmsign2, which is MIT-licensed (© Frank Denis). The MIT license requires that its copyright notice and permission text be retained in derivative works.

Today the sigil repo has:

• no LICENSE file (GitHub detects no license), and
• no attribution to wasmsign2 anywhere (README / NOTICE / CHANGELOG).

Several wasmsign2 source files still live in sigil (heavily modified but derived): src/lib.rs, src/lib/src/error.rs, src/lib/src/signature/mod.rs, src/cli/main.rs. So the MIT notice obligation applies.

Context (how far diverged — attribution is due, but sigil is overwhelmingly original)

• Diverged from wasmsign2 at 2025-03-11; sigil +236 commits since vs upstream's +33.
• ~2,775 → 49,681 Rust LOC (18×); the signing engine (signature/{hash,keys,matrix,multi,simple,sig_sections}, wasm_module/*) is largely rewritten/replaced.

Ask

1. Add a LICENSE for sigil's own terms.
2. Add a NOTICE (or THIRD-PARTY-LICENSES) retaining Frank Denis's MIT copyright + the MIT permission text for the wasmsign2-derived portions.
3. One line in the README: "sigil began as a takeover of wasmsign2 (MIT, © Frank Denis) and has since diverged substantially."

Filed from a website-claims/lineage audit. The site now credits wasmsign2; this closes the gap in the repo where the MIT notice is actually load-bearing.