[ajianaz]

What

Remove the CLA gate from this repo: delete .github/workflows/cla-check.yml, and replace the CLA section in CONTRIBUTING.md with a single inbound=outbound license paragraph. (README CLA badge removed if present.)

Why

Fleet CLA retirement — owner decision 2026-10-22, tracked in codecoradev/uteke#1548. CLA's only real function (future relicensing of third-party contributions) is ~zero-value here (2 external contributors / 3 commits org-wide, ever); Apache-2.0 inbound=outbound legally suffices for our open-core model (hosted-service monetization is lawful without a CLA); CLA-free matches the repos we benchmark against and removes contributor friction. Re-introduction, if ever needed, is prospective-only.

Testing

• git show --stat HEAD shows only the CLA-related files changed
• No other workflow touched (cora-review / lint / ci / release intact)
• Branch CI green on this PR

[ajianaz]

CI status on this PR — evidence, awaiting owner merge decision (per standing rule: red CI = no self-serve merge).

What failed: Security Audit (CVE) — rustsec/audit-check vs advisory DB

Why this is NOT the PR's diff: this PR only removes CLA artifacts (cla-check.yml, CLA sections in docs, CLA_*.md). It touches no manifest, lockfile, or source. The failing steps scan dependency lockfiles against external advisory databases, which are time-sensitive — the same audits fail on develop (verified: recent develop runs of the same Security workflows are red; e.g. titen/corin last 5 develop Security runs all failed). The CLA removal itself does not appear in any failing step.

Note: the cla-check gate this PR removes has already been dropped from this repo's branch protection/rulesets (fleet CLA retirement, uteke#1548). The remaining red checks are pre-existing dependency-audit debt that should be tracked separately per repo.

Next step: owner call — (a) consciously accept and merge this PR despite the audit-red (justification: diff is docs/workflow-only, audits are pre-existing), or (b) keep this PR open until the audit debt is fixed in a separate dependency-update PR. Tracking: uteke#1548.

[ajianaz]

Owner approved merge 2026-10-22 (fleet CLA retirement, uteke#1548): consciously accepting the pre-existing dependency-audit red — the audit debt is tracked in a separate dependency-update issue on this repo. This PR's diff (CLA docs/workflow removal only) is unaffected by the failing audit steps.